CVE-2024-11366

Summary

CVE-2024-11366 is a Reflected Cross-Site Scripting (XSS) vulnerability affecting the SEO Landing Page Generator plugin for WordPress. This issue, present in all versions up to and including 1.66.2, stems from the use of add_query_arg without proper escaping on URLs. Consequently, unauthenticated attackers can inject malicious scripts into webpages, potentially gaining control over user sessions if they can lure a user into taking a specific action, such as clicking on a malicious link.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.