PT-2025-2120 · WordPress · Car Demon

Chocotaco + 3 · Published 2025-01-14 · Updated 2025-01-15 · CVE-2024-13334

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Car Demon plugin for WordPress versions up to, and including, 1.8.1

Description The Car Demon plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the search condition parameter due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

Recommendations For Car Demon plugin for WordPress versions up to, and including, 1.8.1, update to a version later than 1.8.1 to resolve the issue. As a temporary workaround, consider restricting access to the search condition parameter to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-13334

Affected Products

Car Demon

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2024-13334 · Security Note
• https://twitter.com/CVEnew/status/1879490167502991746 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/6d50b1c0-9687-4ce2-bfba-c2d6a2fc28dd?source=cve · Note
• https://twitter.com/rgrsmashdos/status/1879250472500088950 · Twitter Post
• https://plugins.trac.wordpress.org/browser/car-demon/trunk/search/search-form.php · Note
• https://twitter.com/VulmonFeeds/status/1879400454754316669 · Twitter Post
• https://t.me/cvedetector/15403 · Telegram Post
• https://t.me/cvenotify/107421 · Telegram Post