CVE-2024-56027
Published: 02 January 2025
Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bizswoop Leads CRM leads-crm allows Reflected XSS.This issue affects Leads CRM: from n/a through <= 2.0.13.
Security Summary
CVE-2024-56027 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Reflected Cross-site Scripting (XSS) under CWE-79, in the bizswoop Leads CRM (leads-crm) WordPress plugin. This issue affects all versions of the plugin from n/a through 2.0.13.
The vulnerability can be exploited by remote attackers over the network (AV:N) with low attack complexity (AC:L), requiring no privileges (PR:N) but user interaction (UI:R). Exploitation changes scope (S:C) and results in low impacts to confidentiality, integrity, and availability (C:L/I:L/A:L), yielding a CVSS v3.1 base score of 7.1.
Mitigation details are available in the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/leads-crm/vulnerability/wordpress-leads-crm-plugin-2-0-13-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve.
Details
- CWE(s)