FeedlyFeedly
CVEsCVEs
Threat IntelligenceThreat Intelligence
Threat IntelligenceThreat Intelligence
Log in
ChangelogChangelog
ChangelogChangelog
Log in
Log in
Start Free Trial
Start Free Trial
FeedlyFeedly
CVEsCVEs
Threat IntelligenceThreat Intelligence
Threat IntelligenceThreat Intelligence
Log in
ChangelogChangelog
ChangelogChangelog
Log in
Log in
Start Free Trial
Start Free Trial

CVE-2024-9438

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) (CWE-80)

Published: Oct 29, 2024 / Updated: 21d ago

010
CVSS 6.1EPSS 0.05%Medium
CVE info copied to clipboard

The SEUR Oficial plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'change_service' parameter in all versions up to, and including, 2.2.11 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Timeline

First Article

Feedly found the first article mentioning CVE-2024-9438. See article

Oct 29, 2024 at 8:49 AM / Vulners.com RSS Feed
CVSS Estimate

Feedly estimated the CVSS score as MEDIUM

Oct 29, 2024 at 8:49 AM
CVE Assignment

NVD published the first details for CVE-2024-9438

Oct 29, 2024 at 9:15 AM
CVSS

A CVSS base score of 6.1 has been assigned.

Oct 29, 2024 at 9:20 AM / nvd
EPSS

EPSS Score was set to: 0.05% (Percentile: 21.6%)

Oct 30, 2024 at 10:18 AM
Static CVE Timeline Graph

Affected Systems

Seur_oficial_project/seur_oficial
+null more

Attack Patterns

CAPEC-18: XSS Targeting Non-Script Elements
+null more

News

Medium - CVE-2024-9438 - The SEUR Oficial plugin for WordPress is...
Security-Database Alerts Monitor : Last 100 Alerts / 21d
The SEUR Oficial plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'change_service' parameter in all versions up to, and including, 2.2.11 due to insufficient...
null
21d
- MEDIUM - CVE-2024-9438 The SEUR Oficial plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'change_service' parameter in all versions up to, and including, 2.2.11 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVE-2024-9438 - "SEUR Oficial WordPress Reflected Cross-Site Scripting"
Latest Vulnerabilities / 21d
CVE ID : CVE-2024-9438 Published : Oct. 29, 2024, 9:15 a.m. 19 minutes ago Description : The SEUR Oficial plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'change_service' parameter in all versions up to, and including, 2.2.11 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Severity: 6.1
CVE-2024-9438
National Vulnerability Database / 21d
The SEUR Oficial plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'change_service' parameter in all versions up to, and including, 2.2.11 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVE / 21d
Content warning: WORDPRESS SEUROFICIAL SEUR OFICIAL CVE-2024-9438 CVE-2024-9438 SEUR Oficial https://www. cve.org/CVERecord?id=CVE-2024- 9438 https://www. wordfence.com/threat-intel/vul nerabilities/id/88edf229-2be2-49d0-b500-e8ff7708f806?source=cve https:// plugins.trac.wordpress.org/bro wser/seur/trunk/core/pages/seur-get-labels.php#L60 https:// plugins.trac.wordpress.org/cha ngeset/3176965/seur/trunk/core/pages/seur-get-labels.php # wordpress # seuroficial # SEUROficial # CVE_2024_9438 # bot
See 2 more articles and social media posts

CVSS V3.1

Attack Vector:Network
Attack Complexity:Low
Privileges Required:None
User Interaction:Required
Scope:Changed
Confidentiality:Low
Integrity:Low
Availability Impact:None

Categories

CVSS 6.1(29815)CWE-80(307)

Be the first to know about critical vulnerabilities

Collect, analyze, and share vulnerability reports faster using AI

Feedly Threat Intelligence30-day free trial