Reflected Cross-Site Scripting in LDD Directory Lite Plugin for WordPress

CVE-2024-12540

What is CVE-2024-12540?

The LDD Directory Lite plugin, available for WordPress, is susceptible to reflected cross-site scripting vulnerabilities across all versions up to and including 3.3. This flaw arises from the inadequate escaping of URLs during the execution of the remove_query_arg function. As a result, unauthenticated attackers could potentially craft malicious scripts that, if a user interacts with a crafted link, may execute in the context of the user’s session. This exploit poses significant risks to users by allowing attackers to hijack sessions or manipulate site content.

References