PT-2024-22444 · WordPress · Visual Footer Credit Remover

1337_Wannabe + 1 · Published 2024-05-09 · Updated 2024-05-14 · CVE-2024-2846

Positive Technologies (AI Summary)

CVSS v3.1

4.4

Medium

Base vector

AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Visual Footer Credit Remover plugin for WordPress versions up to, and including, 2

Description The issue allows authenticated attackers with administrator-level access to inject arbitrary web scripts in pages via the selector parameter due to insufficient input sanitization and output escaping. This makes it possible for injected scripts to execute whenever a user accesses an injected page. The issue only affects multi-site installations and installations where unfiltered html has been disabled.

Recommendations For Visual Footer Credit Remover plugin for WordPress versions up to, and including, 2, consider disabling the plugin until a patch is available to prevent exploitation. Restrict access to the selector parameter to minimize the risk of arbitrary web script injection. Avoid using the selector parameter in affected pages until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-2846

Affected Products

Visual Footer Credit Remover

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2024-2846 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/9fcb65a0-4218-4728-9c29-0d1a03f438a6?source=cve · Note
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3081401%40visual-footer-credit-remover&new=3081401%40visual-footer-credit-remover&sfp_email=&sfph_mail= · Note