CVE-2024-12407

Summary

CVE-2024-12407 is a Reflected Cross-Site Scripting (XSS) vulnerability affecting the Push Notification plugin for WordPress and BuddyPress, up to version 2.06. Attackers can inject arbitrary web scripts through the 'pushnotificationid' parameter, which can be executed if a user is tricked into clicking on a malicious link. The issue stems from insufficient input sanitization and output escaping in the plugin, posing a significant security risk. Unauthenticated attackers can exploit this vulnerability to steal user data or take control of their accounts. Users are urged to update to the latest version of the plugin to mitigate this risk.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.