CVE-2024-8981
CVSS 3.1 Score 7.1 of 10 (high)
Details
Published Oct 1, 2024
Updated: Oct 4, 2024
CWE ID 80
Summary
CVE-2024-8981 is a Reflected Cross-Site Scripting (XSS) vulnerability affecting the Broken Link Checker plugin for WordPress. The issue lies in the use of the add_query_arg function in /app/admin-notices/features/class-view.php without proper escaping of URLs. This flaw enables unauthenticated attackers to inject malicious scripts into pages, potentially tricking users into clicking on malicious links and executing the scripts. The vulnerability affects all versions of the plugin up to and including 2.4.0.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.