CVE-2024-9938

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)

Published: Nov 16, 2024 / Updated: 4d ago

Gravedad 3.1 (CVSS 3.1 Base Score) Gravedad 3.1 Txt Gravedad 3.1 (CVSS 3.1 Base Score)

Kasperta - MEDIUM - CVE-2024-9938 The Bounce Handler MailPoet 3 plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versions up to, and including, 1.3.21 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

CVE ID : CVE-2024-9938 Published : Nov. 16, 2024, 4:15 a.m. 51 minutes ago Description : The Bounce Handler MailPoet 3 plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versions up to, and including, 1.3.21 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Severity: 6.1

Content warning: WORDPRESS KASPERTA BOUNCE HANDLER MAILPOET 3 CVE-2024-9938 CVE-2024-9938 Bounce Handler MailPoet 3 https://www. cve.org/CVERecord?id=CVE-2024- 9938 https://www. wordfence.com/threat-intel/vul nerabilities/id/d2c6fefe-f6f3-44ce-906c-abad717840d5?source=cve https:// plugins.trac.wordpress.org/bro wser/bounce-handler-mailpoet/trunk/includes/class-mailpoet-bounce-log.php#L193 # wordpress # kasperta # BounceHandlerMailPoet3 # CVE_2024_9938 # bot

The Bounce Handler MailPoet 3 plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versions up to, and including, 1.3.21 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a...