PT-2024-37866 · WordPress · Wp Ulike

Stealthcopter · Published 2024-09-05 · Updated 2024-09-06 · CVE-2024-6792

Positive Technologies (AI Summary)

CVSS v3.1

3.5

Low

Base vector

AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions WP ULike versions prior to 4.7.2.1

Description The issue arises from the WP ULike WordPress plugin's failure to properly sanitize user display names when rendering them on a public page. This can lead to potential security risks, including the possibility of attackers injecting malicious scripts.

Recommendations For versions prior to 4.7.2.1, update to version 4.7.2.1 or later to resolve the issue. As a temporary workaround, consider restricting the display of user-generated content on public pages until the update is applied.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-6792

Affected Products

Wp Ulike

References · 8

• 🔥 https://wpscan.com/vulnerability/3c470edd-4b9b-461e-839f-f3a87f0060aa · Exploit
• https://osv.dev/vulnerability/CVE-2024-6792 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-6792 · Security Note
• https://twitter.com/CVEnew/status/1831940754169553367 · Twitter Post
• https://t.me/cvenotify/93510 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1832007488297685444 · Twitter Post
• https://t.me/cvedetector/4953 · Telegram Post
• https://twitter.com/oktsec/status/1831969080221254027 · Twitter Post