CVE-2024-11375

Summary

CVE-2024-11375 is a Reflected Cross-Site Scripting (XSS) vulnerability affecting the WC1C plugin for WordPress. The flaw, present in all versions up to 0.23.0, stems from the improper use of add_query_arg without appropriate escaping on URLs. An attacker can exploit this vulnerability by injecting malicious scripts into pages, potentially tricking users into clicking malicious links and executing the scripts. Unauthenticated attackers can leverage this flaw to launch attacks, posing a significant risk to WordPress websites running the affected plugin.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.