CVE-2024-13628

MEDIUMNuclei

WP Pricing Table <= 1.1 - Reflected XSS

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2024-13628 has a selected CVSS score of 6.1 (medium); EIP currently links 1 Nuclei template.

Description

The WP Pricing Table WordPress plugin through 1.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationPoC
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Feb 26, 2025 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

WP Pricing Table

Default status: affected

CVE ListThrough 1.1affected

Nuclei templates

1
ProjectDiscoveryMEDIUMWP Pricing Table - Reflected XSSCVSS 6.1

WP Pricing Table WordPress plugin <= 1.1 contains a reflected cross-site scripting caused by unsanitized parameter output, letting attackers execute scripts in the context of high privilege users, exploit requires attacker to craft malicious URL.

Impact

Attackers can execute arbitrary scripts in the context of high privilege users, potentially leading to session hijacking or account compromise.

Remediation

Update to the latest version of WP Pricing Table plugin that addresses the vulnerability or apply security patches.

WeaknessesCWE-79
AuthorsSourabh-Sahu
Template tagscvecve2024codecabinwp-pricing-tablewordpresswpwp-pluginauthenticatedxss
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:codecabin:wp_pricing_table:*:*:*:*:*:wordpress:*:*
https://wpscan.com/vulnerability/34d6c8a2-e70d-485c-a217-4a569c16b079/

Source: ProjectDiscovery

References

2