Reflected XSS Vulnerability in Moloni Affects Versions n/a through 4.7.4
CVE-2024-38694

7.1HIGH

Key Information:

Vendor

WordPress
Status
Moloni
Vendor
CVE Published:
20 July 2024

What is CVE-2024-38694?

The Moloni product has been identified to contain a reflected Cross-site Scripting (XSS) vulnerability, enabling attackers to inject malicious scripts into web pages viewed by users. This issue affects all versions up to 4.7.4, which allows for the injection of untrusted data into outputs without sufficient validation or escaping. As a result, attackers can exploit this flaw to conduct malicious activities such as data theft, session hijacking, or spreading malware through deceptive links, compromising user interaction with the product.

Affected Version(s)

Moloni <= 4.7.4

References

https://patchstack.com/database/vulnerability/moloni/word...
vdb-entry

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Yudistira Arya (Patchstack Alliance)
.