CVE-2024-8799

Summary

CVE-2024-8799 is a Reflected Cross-Site Scripting (XSS) vulnerability affecting the Custom Banners plugin for WordPress. Versions up to 3.3 of this plugin are impacted, allowing unauthenticated attackers to inject arbitrary web scripts. This is due to the use of add_query_arg function without proper escaping, which allows an attacker to manipulate the URL. Successful exploitation of this vulnerability requires users to be tricked into clicking on a malicious link, potentially leading to code execution in their web browser. WordPress users are urged to update the Custom Banners plugin to the latest version to mitigate this risk.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.