PT-2025-1931 · WordPress · Bulk Me Now!

Bob Matyas · Published 2025-01-30 · Updated 2025-05-11 · CVE-2024-12708

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Bulk Me Now! WordPress plugin through 2.0

Description The issue is related to the plugin not validating and escaping some of its shortcode attributes before outputting them back in a page or post, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.

Recommendations Bulk Me Now! WordPress plugin through 2.0: Update the plugin to a version that properly validates and escapes shortcode attributes to prevent Stored Cross-Site Scripting attacks.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-12708

Affected Products

Bulk Me Now!

References · 7

• 🔥 https://wpscan.com/vulnerability/8f30a37e-b9d0-467b-a0e3-20dc0a9f2b61 · Exploit
• https://osv.dev/vulnerability/CVE-2024-12708 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-12708 · Security Note
• https://t.me/cvenotify/121692 · Telegram Post
• https://twitter.com/CVEnew/status/1884848658304151739 · Twitter Post
• https://t.me/cvedetector/16738 · Telegram Post
• https://t.me/cvenotify/109124 · Telegram Post