Cross-Site Scripting Vulnerability in User Referral Plugin by Md Maruf Adnan Sami
CVE-2024-56037

7.1HIGH

Key Information:

Vendor

WordPress
Status
User Referral
Vendor
CVE Published:
2 January 2025

What is CVE-2024-56037?

A reflected cross-site scripting (XSS) vulnerability exists in the User Referral plugin developed by Md Maruf Adnan Sami. This vulnerability occurs due to improper neutralization of user input during web page generation, allowing attackers to inject malicious scripts. When exploited, this can compromise user confidentiality and integrity, as well as lead to unauthorized access to sensitive information. Affected versions range from n/a through 8.0, posing a significant risk to users relying on this functionality for referral management.

Affected Version(s)

User Referral <= 8.0

References

https://patchstack.com/database/wordpress/plugin/user-ref...
vdb-entry

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

SOPROBRO (Patchstack Alliance)
.
CVE-2024-56037 : Cross-Site Scripting Vulnerability in User Referral Plugin by Md Maruf Adnan Sami