PT-2025-3712 · WordPress · Enable Accessibility

Dale Mavers + 1 · Published 2025-01-07 · Updated 2025-01-07 · CVE-2024-9208

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Enable Accessibility plugin for WordPress versions up to, and including, 1.4.1

Description The issue arises from the use of add query arg and remove query arg without proper escaping on the URL, allowing unauthenticated attackers to inject arbitrary web scripts in pages. This can be achieved if an attacker successfully tricks a user into performing an action, such as clicking on a link.

Recommendations For versions up to, and including, 1.4.1, update to a version that includes the necessary escaping for add query arg and remove query arg to prevent Reflected Cross-Site Scripting attacks. As a temporary workaround, consider restricting access to pages that utilize the add query arg and remove query arg functions until a patch is available.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-9208

Affected Products

Enable Accessibility

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2024-9208 · Security Note
• https://t.me/cvedetector/14445 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/da125e31-4747-46b7-8a46-a234388035c0?source=cve · Note
• https://twitter.com/CVEnew/status/1876487513751072896 · Twitter Post
• https://plugins.trac.wordpress.org/browser/enable-accessibility/tags/1.4.1/includes/accessibility-attachments-alt.php#L62 · Note