Reflected Cross-Site Scripting in LDD Directory Lite Plugin for WordPress

CVE-2024-12540

What is CVE-2024-12540?

The LDD Directory Lite plugin, available for WordPress, is susceptible to reflected cross-site scripting vulnerabilities across all versions up to and including 3.3. This flaw arises from the inadequate escaping of URLs during the execution of the remove_query_arg function. As a result, unauthenticated attackers could potentially craft malicious scripts that, if a user interacts with a crafted link, may execute in the context of the user’s session. This exploit poses significant risks to users by allowing attackers to hijack sessions or manipulate site content.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References