Unauthenticated Cross-Site Scripting Vulnerability in Optin Hound Plugin

CVE-2024-9267

What is CVE-2024-9267?

The Optin Hound plugin for WordPress contains a Reflected Cross-Site Scripting vulnerability due to inadequate escaping of the URL when using the add_query_arg function. This flaw exists in all versions up to and including 1.4.3, allowing unauthenticated attackers to craft malicious URLs. If a user is lured into interacting with such a link, the attacker can execute arbitrary web scripts on the affected page. This vulnerability poses significant risks, as it allows attackers to manipulate user interactions, potentially compromising user data and site integrity.

References