CVE-2024-10152

HIGHNuclei

Simple Certain Time to Show Content < 1.3.1 - Reflected XSS

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2024-10152 has a selected CVSS score of 7.1 (high); EIP currently links 1 Nuclei template.

Description

The Simple Certain Time to Show Content WordPress plugin before 1.3.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationPoC
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Feb 26, 2025 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

Simple Certain Time to Show Content

Default status: unaffected

CVE ListBefore 1.3.1affected

Nuclei templates

1
ProjectDiscoveryHIGHSimple Certain Time to Show Content - Cross-Site ScriptingCVSS 7.1

Simple Certain Time to Show Content WordPress plugin < 1.3.1 contains a reflected cross-site scripting caused by lack of sanitization and escaping of a parameter before outputting it in the page, letting attackers execute arbitrary scripts in the context of high privilege users such as admin, exploit requires attacker to craft a malicious URL.

Impact

Attackers can execute arbitrary scripts in the context of high privilege users, potentially leading to session hijacking or privilege escalation.

Remediation

Update to version 1.3.1 or later.

WeaknessesCWE-79
AuthorsSourabh-Sahu
Template tagscvecve2024elementengagesimple-certain-time-to-show-contentwordpresswpwp-pluginauthenticatedxss
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
CPE: cpe:2.3:a:elementengage:simple_certain_time_to_show_content:*:*:*:*:*:wordpress:*:*
https://wpscan.com/vulnerability/b4d17da2-4c47-4fd1-a6bd-6692b07cf710/ https://nvd.nist.gov/vuln/detail/CVE-2024-10152

Source: ProjectDiscovery

References

2