CVE-2024-13097

MEDIUMNuclei

WP Finance <= 1.3.6 - Reflected XSS

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2024-13097 has a selected CVSS score of 5.4 (medium); EIP currently links 1 Nuclei template.

Description

The WP Finance WordPress plugin through 1.3.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationPoC
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Feb 4, 2025 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

WP Finance

Default status: affected

CVE ListThrough 1.3.6affected

Nuclei templates

1
ProjectDiscoveryMEDIUMWP Finance Plugin <= 1.3.6 - Cross-Site ScriptingCVSS 5.4

WP Finance WordPress plugin <= 1.3.6 contains a reflected cross-site scripting caused by lack of sanitization and escaping of a parameter before output, letting attackers execute scripts in high privilege users' browsers, exploit requires victim to click a malicious link.

Impact

Attackers can execute malicious scripts in high privilege users' browsers, potentially leading to session hijacking or account compromise.

Remediation

Update to the latest version of WP Finance plugin that addresses this issue or apply security patches that sanitize and escape output properly.

WeaknessesCWE-79
AuthorsSourabh-Sahu
Template tagscvecve2024wp-financewpwordpresswp-pluginxssauthenticated
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
CPE: cpe:2.3:a:mch0lic:wp_finance:*:*:*:*:*:wordpress:*:*
https://wpscan.com/vulnerability/d83d7274-55ae-4f35-b65e-6d6e19e36fac/ https://nvd.nist.gov/vuln/detail/CVE-2024-13097

Source: ProjectDiscovery

References

2