WordPress Captcha Plugin Vulnerable to Reflected Cross-Site Scripting
CVE-2024-9375

6.1MEDIUM

Key Information:

Vendor

Wordpress
Status
Captcha Bank
Vendor
CVE Published:
4 October 2024

What is CVE-2024-9375?

The Captcha Bank plugin for WordPress contains a vulnerability that allows for Reflected Cross-Site Scripting (XSS). This issue arises from the incorrect implementation of the add_query_arg function, which lacks proper escaping on URLs. The flaw enables potential attackers, who do not need to authenticate, to craft malicious scripts that, upon clicking a deceivingly harmless link, could execute within the context of a user’s session. Such exploits not only compromise the integrity of web applications but also threaten the privacy and security of end-users.

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/captcha-bank/t...

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

.