CVE-2024-9777
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
Published: Nov 19, 2024 / Updated: 15h ago
010
CVSS 6.1No EPSS yetMedium
CVE info copied to clipboard
The Ashe theme for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.243. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Timeline
First Article
Feedly found the first article mentioning CVE-2024-9777. See article
Nov 19, 2024 at 12:52 PM / CVE
CVSS Estimate
Feedly estimated the CVSS score as MEDIUM
Nov 19, 2024 at 12:56 PM
CVE Assignment
NVD published the first details for CVE-2024-9777
Nov 19, 2024 at 1:15 PM
CVSS
A CVSS base score of 6.1 has been assigned.
Nov 19, 2024 at 1:20 PM / nvd
Affected Systems
Wordpress/wordpress
+null more
Attack Patterns
CAPEC-209: XSS Using MIME Type Mismatch
+null more
News
Medium - CVE-2024-9777 - The Ashe theme for WordPress is vulnerable to...
The Ashe theme for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.243....
Ashe <= 2.243 - Reflected Cross-Site Scripting via add_query_arg Parameter
WProyal - MEDIUM - CVE-2024-9777 The Ashe theme for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.243. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVE-2024-9777 Ashe <= 2.243 - Reflected Cross-Site Scripting via add_query_arg Parameter
The Ashe theme for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.243. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a...
cveNotify : 🚨 CVE-2024-9777The Ashe theme for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.243. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.🎖@cveNotify
cveNotify : 🚨 CVE-2024-9777The Ashe theme for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.243. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.🎖@cveNotify
CVE-2024-9777 - Ashe WordPress Reflected Cross-Site Scripting
CVE ID : CVE-2024-9777 Published : Nov. 19, 2024, 1:15 p.m. 50 minutes ago Description : The Ashe theme for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.243. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Severity: 6.1
See 4 more articles and social media posts