CVE-2024-56024
Published: 02 January 2025
Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DuoGeek Custom Dashboard Widget create-custom-dashboard-widget allows Reflected XSS.This issue affects Custom Dashboard Widget: from n/a through <= 1.0.0.
Security Summary
CVE-2024-56024 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Reflected Cross-site Scripting (XSS) under CWE-79, in the DuoGeek Custom Dashboard Widget WordPress plugin (create-custom-dashboard-widget). This issue affects all versions of the plugin up to and including 1.0.0.
The vulnerability carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating network accessibility, low attack complexity, no required privileges, and user interaction such as clicking a malicious link. Remote attackers can exploit it by tricking authenticated users, typically administrators, into processing crafted input via the plugin's functionality, leading to script execution in the victim's browser context with changed scope and low impacts on confidentiality, integrity, and availability.
The Patchstack advisory provides details on this WordPress plugin vulnerability, available at https://patchstack.com/database/Wordpress/Plugin/create-custom-dashboard-widget/vulnerability/wordpress-custom-dashboard-widget-plugin-1-0-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve.
Details
- CWE(s)