CVE-2024-9208
CVSS 3.1 Score 6.1 of 10 (medium)
Details
Summary
CVE-2024-9208 is a Reflected Cross-Site Scripting (XSS) vulnerability affecting the Enable Accessibility plugin for WordPress. The issue lies in the plugin's use of add_query_arg and remove_query_arg functions without proper escaping in URLs, which are exploited by unauthenticated attackers. This allows injecting arbitrary web scripts into pages, potentially leading to serious security implications. The vulnerability can be triggered by convincing users to click on malicious links, posing a significant threat to websites running the affected plugin versions up to and including 1.4.1.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.