Vulnerability in WPFactory Helper Plugin Could Lead to Reflected Cross-Site Scripting

CVE-2024-8656

Summary

The WPFactory Helper plugin for WordPress is impacted by a Reflected Cross-Site Scripting vulnerability resulting from improper handling of user-supplied input. The issue arises from the use of the add_query_arg function without necessary escaping, which can be exploited by unauthenticated attackers. By tricking users into clicking a malicious link, attackers can inject arbitrary scripts into web pages, leading to potential security breaches and manipulation of user sessions. This vulnerability affects all versions of the plugin up to and including version 1.7.0.

References