Firework Shoppable Live Video Vulnerable to Cross-site Scripting (XSS) Attacks
CVE-2024-51781

7.1HIGH

Key Information:

Vendor
WordPress
Status
Firework Shoppable Live Video
Vendor
CVE Published:
9 November 2024

Summary

A vulnerability exists in Firework Shoppable Live Video by Loop Now Technologies, Inc. due to improper neutralization of input during web page generation, leading to reflected Cross-site Scripting (XSS). Attackers may exploit this vulnerability to execute arbitrary scripts in the context of the user's browser, potentially stealing sensitive information or hijacking user sessions. This vulnerability affects all versions from n/a through 6.3, highlighting the importance for users to ensure their software is kept up-to-date and to implement adequate input validation measures.

Affected Version(s)

Firework Shoppable Live Video <= 6.3

References

https://patchstack.com/database/vulnerability/firework-vi...
vdb-entry

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

João Pedro Soares de Alcântara - Kinorth (Patchstack Alliance)
.