WordPress Download Plugin & Theme ZIP Plugin <=1.9.1 Reflected XSS (CVE-2024-9232)

From this webpage screenshot, the following key information about the vulnerability can be obtained: 1. Vulnerability Name: A reflected Cross-Site Scripting (XSS) vulnerability exists in the ZIP plugin for Download Plugins and Themes in Dashboard <= 1.9.1. 2. Vulnerability Description: - Explanation of the vulnerability: Due to improper URL escaping in the function, a reflected XSS vulnerability exists in all versions of WordPress <= 1.9.1. - Exploitation: Unauthorized attackers can inject arbitrary scripts by tricking users into performing specific actions (e.g., clicking on a link). 3. Vulnerability ID: - CVE ID: CVE-2024-9232 - CVSS Score: 6.1 (Medium) 4. Public Release Date: October 10, 2024 - Last Updated: October 11, 2024 5. Researcher: vgo0 6. Affected Versions: <= 1.9.1 - Fixed Version: 1.9.2 7. Remediation Recommendation: Upgrade to version 1.9.2 or higher. 8. Reference Links: - plugins.trac.wordpress.org - plugins.trac.wordpress.org 9. Sharing Options: Provides sharing buttons for Facebook, Twitter, LinkedIn, and email. 10. Copyright and Licensing Information: - © Defiant Inc., 2012–2024 - © MITRE Corporation, 1999–2024 11. Vulnerability Database: - Wordfence Intelligence’s WordPress vulnerability database is free and accessible via API for querying. 12. Additional Information: - Offers information about Wordfence’s free and paid products, and how to receive the latest vulnerability alerts from Wordfence. - Provides access to Wordfence’s documentation, learning center, free support, and advanced support services. - Includes links to Wordfence’s news, about Wordfence, affiliate program, career opportunities, contact information, security information, and CVE request form. This information helps users understand the details of the vulnerability and how to remediate and prevent it.

Goal Reached Thanks to every supporter — we hit 100%!

WordPress Download Plugin & Theme ZIP Plugin <=1.9.1 Reflected XSS (CVE-2024-9232)

More from this source