CVE-2024-12299

Summary

CVE-2024-12299 is a Reflected Cross-Site Scripting (XSS) vulnerability affecting the System Dashboard plugin for WordPress. This issue, present in all versions up to 2.8.15, stems from insufficient input sanitization and output escaping of the Filename parameter. Unauthenticated attackers can exploit this flaw by injecting arbitrary web scripts, potentially gaining control over an administrative user's session. Successful exploitation requires the targeted user to perform a specific action, such as clicking a maliciously crafted link.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.