PT-2025-2076 · WordPress · User Messages Wordpress Plugin

Hassan Khan Yusufzai + 1 · Published 2025-01-31 · Updated 2026-02-06 · CVE-2024-13222

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions WordPress User Messages plugin versions through 1.2.4

Description The User Messages WordPress plugin through version 1.2.4 does not properly sanitize and escape a parameter before displaying it on a page. This can lead to a Reflected Cross-Site Scripting issue. This issue could potentially be used to target users with high privileges, such as administrators. The vulnerability involves improper handling of user-supplied input, allowing malicious scripts to be injected into the web page. The vulnerable parameter is not explicitly identified.

Recommendations WordPress User Messages plugin versions prior to 1.2.4 should be updated.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-13222

Affected Products

User Messages Wordpress Plugin

References · 7

• 🔥 https://wpscan.com/vulnerability/069e1f81-448d-4d27-b288-87111dade2f2 · Exploit
• https://osv.dev/vulnerability/CVE-2024-13222 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-13222 · Security Note
• https://twitter.com/CVEnew/status/1885211114411028535 · Twitter Post
• https://twitter.com/vuln_tracker/status/2019813346317594833 · Twitter Post
• https://twitter.com/pdnuclei_bot/status/2019742910686941695 · Twitter Post
• https://t.me/cvedetector/16902 · Telegram Post