Unauthenticated Attackers Can Inject Arbitrary Web Scripts Through Reflected Cross-Site Scripting in 10Web Social Post Feed Plugin

CVE-2024-9607

What is CVE-2024-9607?

The 10Web Social Post Feed plugin for WordPress is susceptible to Reflected Cross-Site Scripting due to improper handling of query parameters via the add_query_arg function. This vulnerability affects all versions up to and including 1.2.9. Unauthenticated attackers could exploit this flaw by crafting malicious links that, when clicked by users, execute arbitrary scripts within their web browsers. This exploit can occur specifically when the 'leave a review' notification is displayed on the webpage, creating an opportunity for attackers to manipulate user actions.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References