Reflected Cross-Site Scripting Vulnerability in Proofreading Plugin for WordPress
CVE-2024-12466
6.1MEDIUM
Summary
The Proofreading plugin for WordPress suffers from Reflected Cross-Site Scripting due to inadequate input sanitization and output escaping in the 'nonce' parameter. Attackers can exploit this vulnerability to inject malicious web scripts into pages, potentially leading users to execute harmful scripts by clicking on deceiving links. This issue is present in all versions up to and including 1.2.1.1, emphasizing the need for immediate updates to maintain site security.
Affected Version(s)
Proofreading * <= 1.2.1.1
References
CVSS V3.1
Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed
Timeline
Vulnerability published
Vulnerability Reserved
Credit
Dale Mavers