CVE-2024-13326

MEDIUMNuclei

iBuildApp <= 0.2.0 - Reflected XSS

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2024-13326 has a selected CVSS score of 6.1 (medium); EIP currently links 1 Nuclei template.

Description

The iBuildApp WordPress plugin through 0.2.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Feb 4, 2025 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

iBuildApp

Default status: affected

CVE ListThrough 0.2.0affected

Nuclei templates

1
ProjectDiscoveryMEDIUMiBuildApp <= 0.2.0 - Reflected Cross-Site ScriptingCVSS 6.1

iBuildApp WordPress plugin through 0.2.0 contains a reflected cross-site scripting caused by unsanitized parameter output in the page, letting attackers execute malicious scripts in the context of high privilege users, exploit requires attacker to craft a malicious URL.

Impact

Attackers can execute malicious scripts in the context of high privilege users, potentially leading to session hijacking or account compromise.

Remediation

Update to version 0.2.1 or later, where input sanitization and output escaping are properly implemented.

WeaknessesCWE-79
AuthorsSourabh-Sahu
Template tagscvecve2024wordpresswpscanwp-pluginibuildappxssauthenticated
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:ibuildapp:ibuildapp:*:*:*:*:*:wordpress:*:*
https://wpscan.com/vulnerability/dc1f755e-63f2-4f5d-a50e-9e2c589e6e4f/ https://nvd.nist.gov/vuln/detail/CVE-2024-13326

Source: ProjectDiscovery

References

2