The WordPress Captcha Plugin by Captcha Bank plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 4.0.36. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
History

Thu, 10 Oct 2024 21:00:00 +0000

Type Values Removed Values Added
First Time appeared Techbanker
Techbanker captcha Bank
CPEs cpe:2.3:a:techbanker:captcha_bank:*:*:*:*:*:wordpress:*:*
Vendors & Products Techbanker
Techbanker captcha Bank

Fri, 04 Oct 2024 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}


Fri, 04 Oct 2024 04:45:00 +0000

Type Values Removed Values Added
Description The WordPress Captcha Plugin by Captcha Bank plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 4.0.36. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Title WordPress Captcha Plugin by Captcha Bank <= 4.0.36 - Reflected Cross-Site Scripting
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 6.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'}


cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published: 2024-10-04T02:04:56.100Z

Updated: 2024-10-04T13:59:17.636Z

Reserved: 2024-09-30T20:45:59.164Z

Link: CVE-2024-9375

cve-icon Vulnrichment

Updated: 2024-10-04T13:59:06.347Z

cve-icon NVD

Status : Analyzed

Published: 2024-10-04T05:15:13.630

Modified: 2024-10-10T20:44:02.900

Link: CVE-2024-9375

cve-icon Redhat

No data.