CVE-2024-12069

Summary

CVE-2024-12069 is a Reflected Cross-Site Scripting (XSS) vulnerability affecting the Lexicata plugin for WordPress. The flaw, present in all versions up to and including 1.0.16, stems from the use of add_query_arg without proper escaping in plugin URLs. This security lapse allows unauthenticated attackers to inject malicious scripts into a user's web session by tricking them into clicking on a specially crafted link. Successful exploitation of this vulnerability could lead to the execution of arbitrary web scripts on the affected WordPress site.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.