CVE-2024-11360

Summary

CVE-2024-11360: The Page Parts plugin for WordPress, used by an estimated 100,000 websites, is susceptible to Reflected Cross-Site Scripting (XSS) attacks. The issue arises due to the plugin's failure to properly escape URLs in all versions up to 1.4.3. Consequently, attackers can inject malicious scripts into web pages, potentially gaining unauthorized access to user data or taking control of the affected site. Unauthenticated users can exploit this vulnerability by tricking a visitor into clicking on a specially crafted link. It is recommended that users of the Page Parts plugin upgrade to the latest version to mitigate this risk.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.