Stored Cross-site Scripting Vulnerability in IP2Location Country Blocker by IP2Location
CVE-2025-24731

5.9MEDIUM

Key Information:

Vendor
Ip2location
Status
Download Ip2location Country Blocker
Vendor
CVE Published:
24 January 2025

Summary

A Stored Cross-site Scripting (XSS) vulnerability resides in the IP2Location Country Blocker plugin, allowing attackers to inject malicious scripts into web pages viewed by users. This flaw arises from improper input neutralization during web page generation, potentially compromising any visitor's session and enabling an attacker to execute harmful code. Users of the affected versions should promptly apply recommended patches to mitigate associated risks.

Affected Version(s)

Download IP2Location Country Blocker <= 2.38.3

References

https://patchstack.com/database/wordpress/plugin/ip2locat...
vdb-entry

CVSS V3.1

Score:
5.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Malvin Valerian Gultom (Patchstack Alliance)
.