Unauthenticated Cross-Site Scripting Vulnerability in WordPress

CVE-2024-8734

Summary

The Lucas String Replace plugin for WordPress exhibits a vulnerability stemming from the use of the add_query_arg function without sufficient URL escaping in all versions up to and including 2.0.5. This security flaw enables unauthorized attackers to execute arbitrary web scripts on affected pages. By deceiving a user into performing a seemingly benign action, such as clicking on a crafted link, an attacker can leverage this vulnerability to execute malicious scripts in the context of the user's session, potentially leading to session hijacking or other malicious activities.

References