Reflected Cross-Site Scripting Vulnerability in Back to Top Button plugin

CVE-2024-8741

What is CVE-2024-8741?

The Beam me up Scotty – Back to Top Button plugin for WordPress has a vulnerability that allows for Reflected Cross-Site Scripting (XSS). This flaw arises from the improper handling of the add_query_arg function, which compromises URL parameters by failing to escape them correctly. As a result, unauthenticated attackers can leverage this vulnerability to inject arbitrary web scripts into pages viewed by users. This situation often requires the attacker to deceive the user into clicking a specially crafted link, which triggers the execution of malicious scripts in the user’s browser, leading to potential data theft or session hijacking.

References