Vulnerability DatabaseCVE-2024-24932

CVE-2024-24932:
WordPress vulnerability analysis and mitigation

Overview

A Reflected Cross-Site Scripting (XSS) vulnerability has been identified in Djo VK Poster Group WordPress plugin versions up to 2.0.3. The vulnerability was discovered by Le Ngoc Anh and was disclosed on February 9, 2024. This security issue has been assigned CVE-2024-24932 and affects the VK Poster Group plugin's web page generation functionality (Patchstack).

Technical details

The vulnerability is classified as a Cross-Site Scripting (XSS) issue due to improper neutralization of input during web page generation. It has received a CVSS v3.1 base score of 6.1 MEDIUM from NIST (Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) and a score of 7.1 HIGH from Patchstack (Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L). The vulnerability is categorized under CWE-79: Improper Neutralization of Input During Web Page Generation (NVD).

Impact

If exploited, this vulnerability could allow malicious actors to inject malicious scripts, including redirects, advertisements, and other HTML payloads into the website. These injected scripts would be executed when visitors access the affected site (Patchstack).

Mitigation and workarounds

While no official patch is available, Patchstack has issued a virtual patch to mitigate this issue by blocking potential attacks. Website administrators are advised to implement these mitigations immediately to protect their sites (Patchstack).