CVSS 3.1 Score 7.4 of 10 (high)


Published Mar 20, 2024


CVE-2024-2459 is a vulnerability found in the UX Flat plugin for WordPress. This vulnerability affects all versions up to and including 4.1 of the plugin. The issue arises from insufficient input sanitization and output escaping on user-supplied attributes, which enables authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages. These injected scripts will execute whenever a user accesses the affected page. The risk score for this vulnerability is 25, indicating a high base severity level. The exploitability score is 3.1, with low privileges required and no user interaction necessary. The attack vector is through the network, while the impact on integrity and confidentiality is low. Remediation steps should be taken to ensure that input sanitization and output escaping are properly implemented in the UX Flat plugin to mitigate this vulnerability's potential danger to organizations using WordPress with this plugin installed.

Explore Beyond the CVE Basics with Recorded Future's Vulnerability Intelligence

Note: This is just a basic overview providing quick insights into CVE-2024-2459 information. Gain full access to comprehensive CVE data, risk scores, prioritization, and mitigation data through Recorded Future's Vulnerability Intelligence:
  • Prioritize with Risk-Based Scoring
  • Explore the Extensive Vulnerability Database
  • Receive Early Alerts on Emerging CVEs
  • Focus on Critical Exploitable Vulnerabilities
  • Streamline Remediation with Integration Options