CVE-2024-35693

HIGHNuclei

WordPress 12 Step Meeting List plugin <= 3.14.33 - Cross Site Scripting (XSS) vulnerability

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2024-35693 has a selected CVSS score of 7.1 (high); EIP currently links 1 Nuclei template.

Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AA Web Servant 12 Step Meeting List 12-step-meeting-list.This issue affects 12 Step Meeting List: from n/a through <= 3.14.33.

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · Jun 6, 2024 · VulnCheck
Reported exploitation
Observed · VulnCheck

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Jun 10, 2024 · Source: CVE List

Affected products and versions

2
ProductSourceVersion range

12 Step Meeting List

Browse AA Web Servant / 12 Step Meeting List

Default status: unaffected

CVE ListThrough 3.14.33affected

12_step_meeting_list

Browse code4recovery / 12_step_meeting_list
VulnCheckVersion data not supplied

Nuclei templates

1
ProjectDiscoveryMEDIUMWordPress 12 Step Meeting List Plugin <= 3.14.33 - Cross-Site ScriptingCVSS 6.1

Code for Recovery 12 Step Meeting List versions up to 3.14.33 contain a reflected cross-site scripting caused by improper input neutralization during web page generation, letting attackers execute malicious scripts in users' browsers, exploit requires attacker to craft a malicious URL.

Impact

Attackers can execute malicious scripts in user browsers, potentially stealing cookies, session tokens, or performing actions on behalf of users.

Remediation

Implement proper input sanitization and output encoding, and update to the latest version.

WeaknessesCWE-79
Authorsintelligent-ears
Template tagscvecve2024wpwordpresswp-pluginxssreflected12-step-meeting-listvkev
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:code4recovery:12_step_meeting_list:*:*:*:*:*:wordpress:*:*
FOFA: body="/wp-content/plugins/12-step-meeting-list/"
https://patchstack.com/database/vulnerability/12-step-meeting-list/wordpress-12-step-meeting-list-plugin-3-14-33-cross-site-scripting-xss-vulnerability https://github.com/code4recovery/12-step-meeting-list/issues/1415 https://wordpress.org/plugins/12-step-meeting-list https://nvd.nist.gov/vuln/detail/CVE-2024-35693

Source: ProjectDiscovery

References

3