nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2024-13634 CVE-2024-13634
MEDIUMNuclei
Post Sync <= 1.1 - Reflected XSS
Record summary
CVE-2024-13634 has a selected CVSS score of 6.1 (medium); EIP currently links 1 Nuclei template.
Description
The Post Sync WordPress plugin through 1.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
Description source: CVE List
Exploitation context
Available material
- Nuclei templates
- 1
CISA SSVC decision
ExploitationPoC
AutomatableNo
Technical impactPartial
CISA Coordinator · SSVC 2.0.3 · Evaluated Feb 26, 2025 · Source: CVE List
Affected products and versions
1| Product | Source | Version range | Status |
|---|---|---|---|
Post SyncDefault status: affected | CVE List | Through 1.1 | affected |
Nuclei templates
1ProjectDiscoveryMEDIUMPost Sync Plugin <= 1.1 - Cross-Site ScriptingCVSS 6.1
Post Sync WordPress plugin <= 1.1 contains a reflected cross-site scripting caused by lack of sanitization and escaping of a parameter before outputting it in the page, letting attackers execute malicious scripts in the context of high privilege users, exploit requires attacker to craft a malicious URL.
Impact
Attackers can execute malicious scripts in the context of high privilege users, potentially leading to session hijacking or account compromise.
Remediation
Update to the latest version of the plugin where the issue is fixed.
WeaknessesCWE-79
AuthorsSourabh-Sahu
Template tagscvecve2024post-syncwordpresswpwp-pluginxssauthenticated
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:wphobby:post_sync:*:*:*:*:*:wordpress:*:*
https://wpscan.com/vulnerability/0e60bf74-19fb-441c-85a8-005def36af9a/ https://nvd.nist.gov/vuln/detail/CVE-2024-13634
Source: ProjectDiscovery
References
2wpscan.comexploitvdb entryTechnical description
https://wpscan.com/vulnerability/0e60bf74-19fb-441c-85a8-005def36af9a