CVE-2025-24602: 
WordPress vulnerability analysis and mitigation

The WP24 Domain Check WordPress plugin version 1.10.14 and earlier contains a Reflected Cross-Site Scripting (XSS) vulnerability. The vulnerability was discovered by Dimas Maulana and was publicly disclosed on December 26, 2024 (Patchstack).

The vulnerability is classified as a Cross-Site Scripting (XSS) issue, specifically of the reflected type. It has been assigned a CVSS v3.1 base score of 7.1 (HIGH) with the following vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. The vulnerability is tracked as CWE-79: Improper Neutralization of Input During Web Page Generation (NVD).

This vulnerability could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into the website which will be executed when guests visit the site (Patchstack).

The vulnerability has been fixed in version 1.10.15 of the WP24 Domain Check plugin. Users are advised to update to this version or later to remove the vulnerability. Patchstack has also issued a virtual patch to mitigate this issue by blocking any attacks until users have updated to a fixed version (Patchstack).