Cross-site Scripting Vulnerability in LGPD Framework
CVE-2024-52465

7.1HIGH

Key Information:

Vendor

WordPress
Status
Lgpd Framework
Vendor
CVE Published:
2 December 2024

What is CVE-2024-52465?

The Data443 LGPD Framework is affected by a vulnerability that allows reflected cross-site scripting (XSS) due to improper neutralization of input during web page generation. This vulnerability permits attackers to inject arbitrary scripts into responses, which can be executed in the context of the user's browser. Users interacting with a compromised version may inadvertently expose sensitive data and experience unauthorized actions. The issue impacts all versions from 'n/a' through 2.0.2, necessitating immediate attention for remediation.

Affected Version(s)

LGPD Framework <= 2.0.2

References

https://patchstack.com/database/wordpress/plugin/lgpd-fra...
vdb-entry

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

SOPROBRO (Patchstack Alliance)
.