Cross-site Scripting Vulnerability in WP Media Category Management
CVE-2024-32950

7.1HIGH

Key Information:

Vendor

WordPress
Status
WP Media Category Management
Vendor
CVE Published:
24 April 2024

What is CVE-2024-32950?

A Cross-Site Scripting (XSS) vulnerability exists in the WP Media Category Management plugin by DeBAAT, allowing attackers to inject malicious scripts into web pages viewed by users. This issue arises from improper handling of input during web page generation, leading to reflected XSS attacks. Affected versions include all releases up to 2.2, exposing users to potential security risks if left unpatched.

Affected Version(s)

WP Media Category Management <= 2.2

References

https://patchstack.com/database/vulnerability/wp-media-ca...
vdb-entry

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

.