CVE-2024-8874

Summary

CVE-2024-8874 is a Reflected Cross-Site Scripting (XSS) vulnerability affecting the AJAX Login and Registration modal popup + inline form plugin for WordPress. Versions up to and including 2.24 are vulnerable to this issue. The weakness stems from the plugin's use of add_query_arg without proper escaping on URLs. Attackers can exploit this vulnerability by injecting arbitrary web scripts into pages, allowing them to execute code when users unknowingly perform certain actions, such as clicking on a malicious link. Successful exploitation could result in unauthorized access to user data or sessions.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.