Reflected XSS Vulnerability in WPHelpful
CVE-2024-51761

7.1HIGH

Key Information:

Vendor
WordPress
Status
WPhelpful
Vendor
CVE Published:
9 November 2024

Summary

A reflected cross-site scripting (XSS) vulnerability exists in the WPHelpful plugin developed by Zack Gilbert and Paul Jarvis. This vulnerability allows attackers to inject malicious scripts into web pages generated by the affected application. Specifically, improper neutralization of user input can occur, which may enable an attacker to execute arbitrary scripts in the context of the user's browser. This issue is present in WPHelpful versions from an unspecified version up to 1.2.4, potentially compromising user data and security. It is critical for users of WPHelpful to be aware of this vulnerability and mitigate associated risks.

Affected Version(s)

WPHelpful <= 1.2.4

References

https://patchstack.com/database/vulnerability/wphelpful/w...
vdb-entry

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Mika (Patchstack Alliance)
.