Reflected Cross-Site Scripting in Hero Mega Menu Plugin for WordPress

CVE-2024-13779

Summary

The Hero Mega Menu plugin for WordPress is susceptible to reflected cross-site scripting (XSS) attacks through its 'index' parameter. This vulnerability arises from inadequate input sanitization and output escaping, allowing unauthenticated attackers to inject malicious web scripts into affected pages. These scripts can execute if an unsuspecting user interacts with a crafted link, potentially leading to theft of sensitive information or session hijacking. It is crucial for users of this plugin to update to the latest version and apply necessary security measures to protect against such attacks.

References