nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2024-0905 CVE-2024-0905
MEDIUM
Fancy Product Designer < 6.1.8 - Reflected Cross Site Scripting
Record summary
CVE-2024-0905 has a selected CVSS score of 6.3 (medium).
Description
The Fancy Product Designer WordPress plugin before 6.1.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against unauthenticated and admin-level users
Description source: CVE List
Exploitation context
CISA SSVC decision
ExploitationPoC
AutomatableNo
Technical impactPartial
CISA Coordinator · SSVC 2.0.3 · Evaluated Jul 5, 2024 · Source: CVE List
Affected products and versions
2| Product | Source | Version range | Status |
|---|---|---|---|
Fancy Product DesignerDefault status: unaffected | CVE List | Before 6.1.8 | affected |
fancy_product_designerBrowse radykal / fancy_product_designerDefault status: unaffected | CVE List | Before 6.1.8 | affected |
References
2wpscan.comexploitvdb entryTechnical description
https://wpscan.com/vulnerability/3b9eba0d-29aa-47e4-b17f-4cf4bbf8b690