Reflected Cross-Site Scripting Vulnerability in AutomatorWP Plugin for WordPress

CVE-2024-12626

What is CVE-2024-12626?

The AutomatorWP plugin, used for no-code automations and integrations in WordPress, is susceptible to a reflected cross-site scripting vulnerability due to inadequate input sanitization and output escaping in the 'a-0-o-search_field_value' parameter. This vulnerability affects all versions up to and including 5.0.9. Exploitation of this flaw may allow unauthenticated attackers to inject malicious scripts into webpages, which can be executed when unsuspecting users interact with affected pages. Furthermore, when combined with the plugin's import and code action features, the vulnerability increases the risk of arbitrary code execution on the server, posing a significant threat to system integrity.

References