Reflected Cross-Site Scripting Vulnerability in PDF Thumbnail Generator Plugin
CVE-2024-8737

6.1MEDIUM

Key Information:

Vendor
Wordpress
Status
PDF Thumbnail Generator
Vendor
CVE Published:
13 September 2024

Summary

The PDF Thumbnail Generator plugin for WordPress contains a vulnerability that enables reflected cross-site scripting (XSS) due to improper usage of the add_query_arg function without adequate escaping. This flaw affects all versions up to and including version 1.3. Attackers can exploit this vulnerability to inject malicious scripts into web pages. If a user is tricked into clicking a specially crafted link, the injected scripts may execute in their browser environment. This results in a potential compromise of sensitive information or session data, highlighting the necessity for users to update their plugins.

Affected Version(s)

PDF Thumbnail Generator * <= 1.3

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/pdf-thumbnail-...
https://plugins.trac.wordpress.org/changeset/3151055/

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Dale Mavers
.