CVE-2024-12736

Summary

CVE-2024-12736 is a Reflected Cross-Site Scripting (XSS) vulnerability affecting the BU Section Editing WordPress plugin. Versions up to 0.9.9 of this plugin are susceptible to the issue. An attacker can exploit this vulnerability by injecting malicious scripts into a parameter and having it reflected back onto a user's page. This could potentially target high-privilege users, such as admins, and compromise their accounts. The plugin does not sanitize or escape the parameter before outputting it back to the user, making it a significant security risk.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.