Reflected Cross-Site Scripting Vulnerability in PDF Thumbnail Generator Plugin
CVE-2024-8737
6.1MEDIUM
Key Information:
- Vendor
Wordpress
- Status
- Vendor
- CVE Published:
- 13 September 2024
What is CVE-2024-8737?
The PDF Thumbnail Generator plugin for WordPress contains a vulnerability that enables reflected cross-site scripting (XSS) due to improper usage of the add_query_arg function without adequate escaping. This flaw affects all versions up to and including version 1.3. Attackers can exploit this vulnerability to inject malicious scripts into web pages. If a user is tricked into clicking a specially crafted link, the injected scripts may execute in their browser environment. This results in a potential compromise of sensitive information or session data, highlighting the necessity for users to update their plugins.
Affected Version(s)
PDF Thumbnail Generator * <= 1.3