WordPress Captcha Plugin Vulnerable to Reflected Cross-Site Scripting

CVE-2024-9375

What is CVE-2024-9375?

The Captcha Bank plugin for WordPress contains a vulnerability that allows for Reflected Cross-Site Scripting (XSS). This issue arises from the incorrect implementation of the add_query_arg function, which lacks proper escaping on URLs. The flaw enables potential attackers, who do not need to authenticate, to craft malicious scripts that, upon clicking a deceivingly harmless link, could execute within the context of a user’s session. Such exploits not only compromise the integrity of web applications but also threaten the privacy and security of end-users.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References