nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2024-13112 CVE-2024-13112
MEDIUMNuclei
WP MediaTagger <= 4.1.1 - Reflected XSS
Record summary
CVE-2024-13112 has a selected CVSS score of 6.1 (medium); EIP currently links 1 Nuclei template.
Description
The WP MediaTagger WordPress plugin through 4.1.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
Description source: CVE List
Exploitation context
Available material
- Nuclei templates
- 1
CISA SSVC decision
ExploitationPoC
AutomatableNo
Technical impactPartial
CISA Coordinator · SSVC 2.0.3 · Evaluated Jan 31, 2025 · Source: CVE List
Affected products and versions
1| Product | Source | Version range | Status |
|---|---|---|---|
WP MediaTaggerDefault status: affected | CVE List | Through 4.1.1 | affected |
Nuclei templates
1ProjectDiscoveryMEDIUMWP MediaTagger <= 4.1.1 - Cross-Site ScriptingCVSS 6.1
WP MediaTagger WordPress plugin <= 4.1.1 contains a reflected cross-site scripting caused by unsanitized parameter output in the page, letting attackers execute malicious scripts in the context of high privilege users, exploit requires user interaction or victim to visit a malicious link.
Impact
Attackers can execute malicious scripts in the context of high privilege users, potentially leading to account compromise or data theft.
Remediation
Update to the latest version of WP MediaTagger plugin that addresses this issue.
WeaknessesCWE-79
AuthorsSourabh-Sahu
Template tagscvecve2024wp-mediataggerwpwp-pluginwordpressxssauthenticated
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:phd38:wp_mediatagger:*:*:*:*:*:wordpress:*:*
https://wpscan.com/vulnerability/155df231-30ef-47bb-aa91-a7deb1779bd1/ https://nvd.nist.gov/vuln/detail/CVE-2024-13112
Source: ProjectDiscovery
References
2wpscan.comexploitvdb entryTechnical description
https://wpscan.com/vulnerability/155df231-30ef-47bb-aa91-a7deb1779bd1