Reflected Cross-Site Scripting Vulnerability in OPSI Israel Domestic Shipments Plugin
CVE-2024-13100
Key Information:
- Vendor
- WordPress
- Vendor
- CVE Published:
- 31 January 2025
Badges
Summary
The OPSI Israel Domestic Shipments WordPress plugin before version 2.6.3 is susceptible to a reflected cross-site scripting vulnerability. This issue arises due to the plugin's failure to properly sanitize and escape user-provided parameters before rendering them on the webpage. Attackers could potentially exploit this weakness to execute arbitrary JavaScript in the context of a user's session, particularly affecting high-privilege users, such as site administrators. This could lead to unauthorized actions or data exposure.
Affected Version(s)
OPSI Israel Domestic Shipments 0 <= 2.6.3
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.
References
CVSS V3.1
Timeline
- 🟡
Public PoC available
- 👾
Exploit known to exist
Vulnerability published
Vulnerability Reserved