Reflected XSS Vulnerability in Jaytesh Barange Posts Date Ranges Plugin for WordPress
CVE-2024-54387

7.1HIGH

Key Information:

Vendor

WordPress
Status
Posts Date Ranges
Vendor
CVE Published:
16 December 2024

What is CVE-2024-54387?

CVE-2024-54387 is a critical security vulnerability affecting the Posts Date Ranges plugin developed by Jaytesh Barange. This vulnerability stems from improper neutralization of user input during web page generation, leading to a reflected cross-site scripting (XSS) attack vector. Attackers can exploit this vulnerability on affected versions (up to 2.2) by manipulating input fields to execute arbitrary JavaScript code in the context of the victim's browser. Successful exploitation can lead to unauthorized actions, data exposure, and potential compromise of user sessions. Website administrators using this plugin are advised to update to the latest version to mitigate this vulnerability.

Affected Version(s)

Posts Date Ranges <= 2.2

References

https://patchstack.com/database/wordpress/plugin/posts-da...
vdb-entry

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Muhamad Agil Fachrian (Patchstack Alliance)
.
CVE-2024-54387 : Reflected XSS Vulnerability in Jaytesh Barange Posts Date Ranges Plugin for WordPress