CVE-2024-11811
CVSS 3.1 Score 6.1 of 10 (medium)
Details
Published Dec 20, 2024
CWE ID 79
Summary
CVE-2024-11811 is a Reflected Cross-Site Scripting (XSS) vulnerability affecting the Feedify – Web Push Notifications plugin for WordPress. The issue lies in the insufficient input sanitization and output escaping of the 'platform', 'phone', 'email', and 'store_url' parameters. This flaw enables unauthenticated attackers to inject arbitrary web scripts into pages, potentially tricking users into clicking malicious links and executing the malicious code. All versions of Feedify up to, and including, 2.4.2 are vulnerable to this exploit.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.