Unsecured URL Injection Vulnerability in Ashe Theme (maximum severity rating: 7.5)

CVE-2024-9777

Summary

The Ashe theme for WordPress has a vulnerability that allows for Reflected Cross-Site Scripting due to improper handling of URLs using the add_query_arg function without necessary escaping. This issue impacts all versions up to and including 2.243. Attackers can exploit this vulnerability to inject arbitrary JavaScript payloads into web pages, which may execute when a user is tricked into clicking on a malicious link. This can lead to session hijacking, phishing attacks, and other malicious activities, highlighting the importance of updates and secure coding practices.

References