Reflected XSS Vulnerability in WP-Lister Lite for Amazon
CVE-2024-30199

7.1HIGH

Key Information:

Vendor
WordPress
Status
WP-lister Lite For Amazon
Vendor
CVE Published:
27 March 2024

Summary

A Cross-site Scripting (XSS) vulnerability exists in the WP Lab WP-Lister Lite for Amazon plugin, specifically affecting versions up to 2.6.8. This vulnerability stems from improper neutralization of user input during web page generation, enabling attackers to execute arbitrary JavaScript in the context of the user's browser. As a result, this could lead to unauthorized actions being performed on behalf of the user, data theft, or other malicious outcomes. It is essential for users of the affected plugin versions to apply necessary updates or implement mitigating strategies to safeguard against potential exploits associated with this vulnerability.

Affected Version(s)

WP-Lister Lite for Amazon <= 2.6.8

References

https://patchstack.com/database/vulnerability/wp-lister-f...
vdb-entry

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Yudistira Arya (Patchstack Alliance)
.