PT-2025-1908 · Stormhill Media · Mybookprogress

Soprobro · Published 2025-01-17 · Updated 2025-01-17 · CVE-2024-12598

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

The MyBookProgress plugin for WordPress, developed by Stormhill Media, is susceptible to Stored Cross-Site Scripting (XSS) attacks due to inadequate input sanitization and output escaping. This issue affects all versions up to and including 1.0.8, specifically through the 'book' parameter. Authenticated attackers with Contributor-level access or higher can inject arbitrary web scripts into pages, which will execute when a user accesses an injected page. An exploit is available, demonstrating the severity of this issue.

Affected versions: up to and including 1.0.8 Vulnerable software: MyBookProgress plugin for WordPress Exploitation method: Stored Cross-Site Scripting via the 'book' parameter

#MyBookProgress #WordPress #StoredXSS #StormhillMedia #CrossSiteScripting

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-12598

Affected Products

Mybookprogress

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2024-12598 · Security Note
• https://twitter.com/VulmonFeeds/status/1880181564379742629 · Twitter Post
• https://twitter.com/CVEnew/status/1880248066835714399 · Twitter Post
• https://t.me/cvenotify/107731 · Telegram Post
• https://wordpress.org/plugins/mybookprogress/#developers · Note
• https://t.me/cvedetector/15688 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/b20a11c1-9aa0-4f5d-af3d-89fb9bf4e1d0?source=cve · Note