CVE-2024-11032

Summary

CVE-2024-11032 is a Reflected Cross-Site Scripting (XSS) vulnerability affecting the Parsi Date plugin for WordPress. Versions up to and including 5.1.1 are susceptible to this issue. Attackers can exploit this vulnerability by injecting arbitrary web scripts into pages, which execute if a user is tricked into performing a specific action, such as clicking on a malicious link. The vulnerability arises due to the plugin's use of add_query_arg without proper escaping on the URL. Unauthenticated attackers can potentially exploit this to launch various attacks, including data theft and site takeover. It is highly recommended that users update the plugin to the latest version to mitigate this risk.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.