Reflected Cross-Site Scripting Vulnerability in Turnkey bbPress by WeaverTheme for WordPress
CVE-2024-12221

6.1MEDIUM

Key Information:

Vendor: Wordpress
Status: Turnkey Bbpress By Weavertheme
Vendor: CVE Published:; 4 January 2025

What is CVE-2024-12221?

The Turnkey bbPress plugin developed by WeaverTheme for WordPress has a vulnerability that allows for reflected cross-site scripting via the ‘_wpnonce’ parameter. This vulnerability exists in all versions up to and including 1.6.3, where inadequate input sanitization and output escaping procedures create an opportunity for unauthenticated attackers. If attackers can deceive users into clicking malicious links, they can execute arbitrary web scripts on the affected pages, potentially compromising user data and site integrity.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

Turnkey bbPress by WeaverTheme * <= 1.6.3

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...

https://wordpress.org/plugins/weaver-for-bbpress/

https://plugins.trac.wordpress.org/changeset/3209473/

CVSS V3.1

Score:

6.1

Severity:

MEDIUM

Confidentiality:

Low

Integrity:

Low

Availability:

Low

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

None

User Interaction:

Required

Scope:

Changed

Timeline

Vulnerability published
Jan 4, 2025
Vulnerability Reserved
Dec 4, 2024

Credit

Dale Mavers

JSON

Wordpress