CVE-2024-13891
CVSS 3.1 Score 7.1 of 10 (high)
Details
Published Mar 13, 2025
Updated: Mar 14, 2025
Summary
CVE-2024-13891 is a Reflected Cross-Site Scripting (XSS) vulnerability affecting the Schedule WordPress plugin before version 1.0.1. The plugin fails to sanitize and escape user input, allowing an attacker to inject malicious scripts into pages viewed by other users. This issue poses a significant risk, particularly for high-privilege users like administrators, who could be tricked into visiting a specially crafted malicious link or opening a malicious file, leading to unauthorized access or data theft.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.