Reflected Cross-Site Scripting Vulnerability in WP Pipes Plugin

CVE-2024-12283

Summary

The WP Pipes plugin for WordPress is prone to a Reflected Cross-Site Scripting vulnerability which arises from improper sanitization of the 'x1' parameter in all versions up to and including 1.4.1. This flaw allows unauthenticated attackers to inject malicious web scripts into web pages, which are subsequently executed in the context of the user’s browser when they are manipulated into clicking a compromised link. This security gap poses significant risks to users, potentially leading to session hijacking, phishing attacks, or information leaks.

References