CVE-2024-11974

Summary

CVE-2024-11974 is a Reflected Cross-Site Scripting (XSS) vulnerability affecting the Media Library Assistant plugin for WordPress. This issue, present in versions up to 3.23, stems from insufficient input sanitization and output escaping of the 'smc_settings_tab', 'unattachfixit-action', and 'woofixit-action' parameters. As a result, unauthenticated attackers can inject arbitrary web scripts into pages, potentially tricking users into executing malicious code by clicking on manipulated links. This poses a significant security risk and requires immediate attention and patching.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.