CVE-2024-29137

HIGHNuclei

WordPress Tourfic plugin <= 2.11.7 - Reflected Cross Site Scripting (XSS) vulnerability

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2024-29137 has a selected CVSS score of 7.1 (high); EIP currently links 1 Nuclei template.

Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themefic Tourfic tourfic.This issue affects Tourfic: from n/a through <= 2.11.7.

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · Mar 18, 2024 · VulnCheck
Reported exploitation
Observed · VulnCheck

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Mar 19, 2024 · Source: CVE List

Affected products and versions

2
ProductSourceVersion range

Tourfic

Browse Themefic / Tourfic

Default status: unaffected

CVE ListThrough 2.11.7affected

tourfic

Browse themefic / tourfic
VulnCheckVersion data not supplied

Nuclei templates

1
ProjectDiscoveryHIGHWordPress Tourfic Plugin <= 2.11.7 - Cross-Site ScriptingCVSS 7.1

The Tourfic plugin for WordPress is vulnerable to Reflected Cross-Site Scripting (XSS) in versions up to and including 2.11.7 due to insufficient input sanitization and output escaping in the 'place' parameter.

Impact

Attackers can execute malicious scripts in users' browsers, potentially stealing cookies, session tokens, or performing actions on behalf of users.

Remediation

Update to Tourfic version 2.11.8 or later.

WeaknessesCWE-79
AuthorsShivam Kamboj
Template tagscvecve2024wordpresswp-pluginxsstourficunauthvkev
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
FOFA: body="/wp-content/plugins/tourfic/"
https://nvd.nist.gov/vuln/detail/CVE-2024-29137 https://patchstack.com/database/vulnerability/tourfic/wordpress-tourfic-plugin-2-11-7-reflected-cross-site-scripting-xss-vulnerability https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/tourfic/tourfic-2117-reflected-cross-site-scripting https://wpscan.com/vulnerability/f93321c7-d4e3-470c-9fd9-8e65c2284c5d/

Source: ProjectDiscovery

References

3