Reflected Cross-Site Scripting Vulnerability in Proofreading Plugin for WordPress
CVE-2024-12466

6.1MEDIUM

Key Information:

Vendor

WordPress
Status
Proofreading
Vendor
CVE Published:
17 January 2025

What is CVE-2024-12466?

The Proofreading plugin for WordPress suffers from Reflected Cross-Site Scripting due to inadequate input sanitization and output escaping in the 'nonce' parameter. Attackers can exploit this vulnerability to inject malicious web scripts into pages, potentially leading users to execute harmful scripts by clicking on deceiving links. This issue is present in all versions up to and including 1.2.1.1, emphasizing the need for immediate updates to maintain site security.

Affected Version(s)

Proofreading * <= 1.2.1.1

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/proofreading/t...
https://plugins.trac.wordpress.org/changeset?sfp_email=&s...

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Dale Mavers
.