CVE-2024-39646

HIGHNuclei

WordPress Custom 404 Pro plugin <= 3.11.1 - Reflected Cross Site Scripting (XSS) vulnerability

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2024-39646 has a selected CVSS score of 7.1 (high); EIP currently links 1 Nuclei template.

Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kunal Custom 404 Pro custom-404-pro.This issue affects Custom 404 Pro: from n/a through <= 3.11.1.

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · Aug 1, 2024 · VulnCheck
Reported exploitation
Observed · VulnCheck

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Aug 2, 2024 · Source: CVE List

Affected products and versions

2
ProductSourceVersion range

Custom 404 Pro

Browse Kunal / Custom 404 Pro

Default status: unaffected

CVE ListThrough 3.11.1affected

custom_404_pro

Browse kunalnagar / custom_404_pro
VulnCheckVersion data not supplied

Nuclei templates

1
ProjectDiscoveryHIGHWordPress Custom 404 Pro <= 3.11.1 - Reflected XSSCVSS 7.1

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Kunal Nagar Custom 404 Pro allows Reflected XSS.This issue affects Custom 404 Pro: from n/a through 3.11.1.

Impact

Attackers can execute arbitrary scripts in victims' browsers, leading to session hijacking, defacement, or redirection.

Remediation

Update to version 3.11.2 or later.

WeaknessesCWE-79
AuthorsSourabh-Sahu
Template tagswordpresswp-pluginxssauthenticatedcvecve2024custom-404-provkev
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
CPE: cpe:2.3:a:kunalnagar:custom_404_pro:*:*:*:*:*:wordpress:*:*
https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/custom-404-pro/custom-404-pro-3111-reflected-cross-site-scripting https://plugins.trac.wordpress.org/changeset?old_path=/custom-404-pro/tags/3.11.1&new_path=/custom-404-pro/tags/3.11.2&sfp_email=&sfph_mail= https://patchstack.com/database/vulnerability/custom-404-pro/wordpress-custom-404-pro-plugin-3-11-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve

Source: ProjectDiscovery

References

3