CVE-2024-37259

HIGHNuclei

WordPress WP Extended plugin <= 2.4.7 - Cross Site Scripting (XSS) vulnerability

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2024-37259 has a selected CVSS score of 7.1 (high); EIP currently links 1 Nuclei template.

Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Extended The Ultimate WordPress Toolkit – WP Extended wpextended.This issue affects The Ultimate WordPress Toolkit – WP Extended: from n/a through <= 2.4.7.

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · Jun 27, 2024 · VulnCheck
Reported exploitation
Observed · VulnCheck

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Jul 22, 2024 · Source: CVE List

Affected products and versions

2
ProductSourceVersion range

The Ultimate WordPress Toolkit – WP Extended

Browse WP Extended / The Ultimate WordPress Toolkit – WP Extendedwpextended

Default status: unaffected

CVE ListThrough 2.4.7affected

wp_extended

Browse wpextended / wp_extended
VulnCheckVersion data not supplied

Nuclei templates

1
ProjectDiscoveryMEDIUMWP Extended < 3.0.0 - Stored Cross-Site ScriptingCVSS 6.1

The Ultimate WordPress Toolkit - WP Extended plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.4.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Impact

Attackers can execute malicious scripts in users' browsers, potentially stealing cookies, session tokens, or performing actions true behalf of users.

Remediation

Update to WP Extended 3.0.0 or later.

WeaknessesCWE-79
Authors0xanis
Template tagscvecve2024wordpresswp-scanwp-pluginwpextendedxssvkev
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
https://wpscan.com/vulnerability/2d90ca7d-e957-4ac6-b1f1-2d631bffa2e8/ https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/wpextended/the-ultimate-wordpress-toolkit-wp-extended-247-unauthenticated-stored-cross-site-scripting https://plugins.trac.wordpress.org/changeset/3099195/wpextended https://nvd.nist.gov/vuln/detail/CVE-2024-37259

Source: ProjectDiscovery

References

3