CVE-2024-13352: 
WordPress vulnerability analysis and mitigation

The Legull WordPress plugin through version 1.2.2 contains a Reflected Cross-Site Scripting vulnerability. The vulnerability was discovered and publicly disclosed on January 17, 2025. The issue affects the plugin's admin interface and could potentially be exploited against high-privilege users such as administrators (WPScan).

The vulnerability stems from improper input sanitization and escaping of a parameter before it is output back in the page. The issue has been assigned a CVSS v3.1 Base Score of 7.1 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L (NVD).

If successfully exploited, this vulnerability could allow attackers to execute arbitrary JavaScript code in the context of an administrator's browser session, potentially leading to unauthorized actions or data theft when an administrator visits a specially crafted URL (WPScan).

A proof of concept exploit has been published demonstrating the vulnerability can be triggered via a specially crafted URL containing malicious JavaScript code: http://example.com/wp-admin/admin.php?page=legull_terms&tab='></script><script>alert(1)</script><script> (WPScan).

The vulnerability was discovered and reported by security researcher Hassan Khan Yusufzai (Splint3r7) (WPScan).