CVE-2024-10483

CVE-2024-10483 is a reflected cross-site scripting (XSS) vulnerability, classified under CWE-79, affecting the Simple:Press Forum WordPress plugin in versions before 6.10.11. The flaw arises because the plugin does not sanitize and escape a parameter before outputting it back in the page, enabling attackers to inject and execute arbitrary JavaScript code in the context of the affected page. The vulnerability received a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating high severity due to its network accessibility and scope change despite requiring user interaction.

Unauthenticated attackers can exploit this vulnerability remotely with low attack complexity by tricking users into interacting with a maliciously crafted URL containing the XSS payload, such as through phishing links or social engineering. Upon execution in the victim's browser, the payload can lead to low-level impacts on confidentiality, integrity, and availability, potentially allowing theft of session cookies, user data, or limited page manipulation within the plugin's context.

The WPScan advisory recommends updating the Simple:Press Forum plugin to version 6.10.11 or later to mitigate the issue, as this release addresses the sanitization and escaping deficiency. Additional details are available at https://wpscan.com/vulnerability/c7e3c473-09b2-473b-87d7-0a01d8f52086/.