CVE-2024-12734

MEDIUMNuclei

Advance Post Prefix <= 1.1.1 - Reflected XSS

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2024-12734 has a selected CVSS score of 6.1 (medium); EIP currently links 1 Nuclei template.

Description

The Advance Post Prefix WordPress plugin through 1.1.1, Advance Post Prefix WordPress plugin through 1.1.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationPoC
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated May 20, 2025 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

Advance Post Prefix

Default status: affected

CVE ListThrough 1.1.1affected

Nuclei templates

1
ProjectDiscoveryMEDIUMAdvance Post Prefix WordPress plugin - Reflected XSSCVSS 6.1

Advance Post Prefix WordPress plugin through 1.1.1 contains a reflected cross-site scripting caused by unsanitized and unescaped parameter output, letting attackers execute scripts against high privilege users such as admin, exploit requires crafted request.

Impact

Attackers can execute scripts in admin users' browsers, potentially leading to account compromise or unauthorized actions.

Remediation

Update to the latest version of Advance Post Prefix WordPress plugin.

WeaknessesCWE-79
AuthorsSourabh-Sahu
Template tagscvecve2024niceitadvance-post-prefixwordpresswpwp-pluginxssauthenticated
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:niceit:advance_post_prefix:*:*:*:*:*:wordpress:*:*
https://wpscan.com/vulnerability/038b44dc-0495-4f56-ae7e-c78a265aa535/ https://nvd.nist.gov/vuln/detail/cve-2024-12734

Source: ProjectDiscovery

References

2