Cross-site Scripting (XSS) Vulnerability in WPCoder WP Coder
CVE-2024-2578

4.8MEDIUM

Key Information:

Vendor
WordPress
Status
WP Coder
Vendor
CVE Published:
21 March 2024

Summary

A Cross-Site Scripting (XSS) vulnerability exists in the WP Coder plugin, enabling attackers to execute malicious scripts in the context of a user's session. This vulnerability allows stored XSS attacks, which can result in unauthorized actions performed on behalf of users, exposure of sensitive information, and potential takeover of user accounts. The issue affects WP Coder in versions ranging from n/a to 3.5, necessitating prompt attention and remediation by website administrators utilizing this plugin.

Affected Version(s)

WP Coder <= 3.5

References

https://patchstack.com/database/vulnerability/wp-coder/wo...
vdb-entry

CVSS V3.1

Score:
4.8
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

LeNgocHoa (Patchstack Alliance)
.