CVE-2024-9443
CVSS 3.1 Score 5.4 of 10 (medium)
Details
Published Nov 5, 2024
Updated: Nov 7, 2024
CWE ID 79
Summary
CVE-2024-9443: The Basticom Framework plugin for WordPress, up to version 1.5.0, contains a Stored Cross-Site Scripting (XSS) vulnerability. This flaw, caused by insufficient sanitization and output escaping of SVG file uploads, enables authenticated attackers with Author-level access and above to inject malicious web scripts. Successful exploitation results in the execution of these scripts whenever a user accesses the affected SVG file.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Share