CVE-2024-12585

MEDIUMNuclei

PropertyHive < 2.1.1 - Reflected XSS

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2024-12585 has a selected CVSS score of 6.1 (medium); EIP currently links 1 Nuclei template.

Description

The Property Hive WordPress plugin before 2.1.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationPoC
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Jan 8, 2025 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

Property Hive

Default status: unaffected

CVE ListBefore 2.1.1affected

Nuclei templates

1
ProjectDiscoveryMEDIUMPropertyHive < 2.1.1 - Cross-Site Scripting

The Property Hive plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'ph_message' parameter in all versions up to, and including, 2.1.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

Impact

Attackers can execute arbitrary scripts in the context of high privilege users, potentially leading to account compromise or data theft.

Remediation

Update to version 2.1.1 or later where input sanitization and escaping are properly implemented.

AuthorsShivam Kamboj
Template tagscvecve2024wordpresswpwp-pluginpropertyhivexssauthenticated
https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/propertyhive/property-hive-210-reflected-cross-site-scripting https://nvd.nist.gov/vuln/detail/CVE-2024-12585

Source: ProjectDiscovery

References

2