CVE-2024-56022
Published: 02 January 2025
Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WordPress Monsters Preloader by WordPress Monsters preloader-sws allows Reflected XSS.This issue affects Preloader by WordPress Monsters: from n/a through <= 1.2.3.
Security Summary
CVE-2024-56022 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Reflected Cross-site Scripting (XSS) under CWE-79. It affects the Preloader by WordPress Monsters WordPress plugin (preloader-sws) in all versions from n/a through 1.2.3.
The vulnerability carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L). Unauthenticated attackers accessible over the network can exploit it with low attack complexity by tricking users into performing actions such as clicking malicious links that reflect attacker-controlled input as executable scripts in the victim's browser. Exploitation enables low impacts on confidentiality, integrity, and availability within a changed scope.
The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/preloader-sws/vulnerability/wordpress-preloader-by-wordpress-monsters-plugin-1-2-3-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve details the reflected XSS issue in Preloader by WordPress Monsters up to version 1.2.3.
Details
- CWE(s)