Hassan Khan Yusufzai
+1
·
Published
2025-02-01
·
Updated
2025-05-07
·
CVE-2024-13099
5.4
Medium
| Base vector | Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N |
Name of the Vulnerable Software and Affected Versions:
Widget4Call WordPress plugin versions 1.0.0 through 1.0.7
Description:
The issue is related to a Reflected Cross-Site Scripting problem. It occurs because a `parameter` is not properly sanitised and escaped before being outputted back in the page. This could be exploited against high privilege users, such as admins.
Recommendations:
For Widget4Call WordPress plugin versions 1.0.0 through 1.0.7, consider updating to a version that properly sanitises and escapes parameters to prevent Reflected Cross-Site Scripting attacks. As a temporary workaround, restrict access to the plugin's functionality to minimize the risk of exploitation.
Exploit
Fix
XSS