The Popularis Extra plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.2.6. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
History

Tue, 08 Oct 2024 19:15:00 +0000

Type Values Removed Values Added
First Time appeared Themes4wp
Themes4wp popularis Extra
CPEs cpe:2.3:a:themes4wp:popularis_extra:*:*:*:*:*:wordpress:*:*
Vendors & Products Themes4wp
Themes4wp popularis Extra

Fri, 04 Oct 2024 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}


Fri, 04 Oct 2024 04:45:00 +0000

Type Values Removed Values Added
Description The Popularis Extra plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.2.6. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Title Popularis Extra <= 1.2.6 - Reflected Cross-Site Scripting
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 6.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'}


cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published: 2024-10-04T02:04:51.507Z

Updated: 2024-10-04T14:00:53.442Z

Reserved: 2024-09-30T16:55:02.152Z

Link: CVE-2024-9353

cve-icon Vulnrichment

Updated: 2024-10-04T14:00:42.753Z

cve-icon NVD

Status : Analyzed

Published: 2024-10-04T05:15:13.037

Modified: 2024-10-08T18:50:51.357

Link: CVE-2024-9353

cve-icon Redhat

No data.