Reflected XSS Vulnerability Affects Ad Inserter
CVE-2024-49248

7.1HIGH

Key Information:

Vendor
WordPress
Status
Ad Inserter
Vendor
CVE Published:
17 October 2024

Summary

The Ad Inserter plugin by Igor Funa is exposed to a significant vulnerability due to improper neutralization of input during web page generation. This flaw allows for reflected Cross-Site Scripting (XSS) attacks, potentially enabling attackers to inject malicious scripts into web pages rendered for users. As a result, users of affected versions, specifically those prior to 2.7.37, could inadvertently expose themselves to security breaches, including the unauthorized execution of scripts. Immediate action is advised to secure affected instances of Ad Inserter and safeguard user interactions.

Affected Version(s)

Ad Inserter <= 2.7.37

References

https://patchstack.com/database/vulnerability/ad-inserter...
vdb-entry

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Rafie Muhammad (Patchstack)
.