Reflected Cross-Site Scripting Vulnerability in SEMA API Plugin for WordPress
CVE-2024-12285

6.1MEDIUM

Key Information:

Vendor
Wordpress
Status
Sema Api
Vendor
CVE Published:
9 January 2025

Summary

The SEMA API plugin for WordPress contains a vulnerability that permits unauthenticated users to execute reflected cross-site scripting attacks. This is achieved through the 'catid' parameter, which lacks adequate input sanitization and output escaping. If attackers can manipulate users into clicking on a specific link, they can inject arbitrary web scripts that are then executed in the context of the user's session. This vulnerability underscores the importance of securing web applications through proper input handling techniques to maintain user trust and data integrity.

Affected Version(s)

SEMA API * <= 5.27

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://wordpress.org/plugins/sema-api/#developers

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Dale Mavers
.