CVE-2024-10146
CVSS 3.1 Score 5.4 of 10 (medium)
Details
Published Nov 14, 2024
Updated: Nov 15, 2024
Summary
CVE-2024-10146 is a Reflected Cross-Site Scripting vulnerability affecting the Simple File List plugin for WordPress before version 6.1.13. The issue lies in the plugin's failure to properly sanitize and escape a generated URL before outputting it back as an attribute, enabling attackers to inject and execute malicious scripts on admin pages. This can potentially lead to unauthorized access, data theft, or further exploitation. Users are strongly advised to update to the latest plugin version to mitigate this risk.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.