WordPress Plum: Spin Wheel & Email Pop-up plugin <= 2.0 - Broken Access Control to Unauth Stored XSS vulnerability

CVE-2024-38744

What is CVE-2024-38744?

The Upqode Plum: Spin Wheel & Email Pop-up experiences a critical issue where missing authorization checks allow unauthorized users to access certain functionalities. This vulnerability also exposes the application to stored cross-site scripting (XSS) attacks, compromising user data and interaction integrity. The affected versions of this plugin range from an unspecified version up to 2.0, necessitating immediate attention and remediation for users to safeguard their data and maintain overall security.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References