CVE-2024-13331

MEDIUMNuclei

WP Dream Carousel <= 1.0.1b - Reflected XSS

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2024-13331 has a selected CVSS score of 6.1 (medium); EIP currently links 1 Nuclei template.

Description

The WP Dream Carousel WordPress plugin through 1.0.1b does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Feb 4, 2025 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

WP Dream Carousel

Default status: affected

CVE ListThrough 1.0.1baffected

Nuclei templates

1
ProjectDiscoveryMEDIUMWP Dream Carousel < 1.0.1b - Cross-Site ScriptingCVSS 6.1

WP Dream Carousel WordPress plugin < 1.0.1b contains a reflected cross-site scripting caused by lack of sanitization and escaping of a parameter before outputting it in the page, letting attackers execute arbitrary scripts in the context of high privilege users, exploit requires victim to load a maliciously crafted URL.

Impact

Attackers can execute arbitrary scripts in the context of high privilege users, potentially leading to account compromise or data theft.

Remediation

Update to version 1.0.1b or later, where the vulnerability is fixed.

WeaknessesCWE-79
AuthorsSourabh-Sahu
Template tagscvecve2024neolokiwp-dream-carouselwordpresswpwp-pluginauthenticatedxss
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:neoloki:wp_dream_carousel:*:*:*:*:wordpress:*:*:*
https://wpscan.com/vulnerability/6425ccff-2e18-4498-b8b1-d493286efc7b/ https://nvd.nist.gov/vuln/detail/CVE-2024-13331

Source: ProjectDiscovery

References

2