CVE-2024-11365

Summary

CVE-2024-11365 is a Reflected Cross-Site Scripting (XSS) vulnerability affecting the Crypto and DeFi Widgets plugin for WordPress. Versions up to and including 1.1.6 of this plugin use add_query_arg without proper escaping, allowing attackers to inject arbitrary web scripts into pages. Unauthenticated attackers can exploit this vulnerability by tricking users into clicking on malicious links, leading to the execution of malicious code on the user's browser. The impact includes unauthorized access to user data or taking control of user sessions. Users are advised to update the plugin to the latest version or consider disabling it until a patch is available.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.