CVE-2024-56032
Published: 02 January 2025
Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FolioVision FV Descriptions fv-descriptions allows Reflected XSS.This issue affects FV Descriptions: from n/a through <= 1.4.
Security Summary
CVE-2024-56032 is an Improper Neutralization of Input During Web Page Generation vulnerability, enabling Reflected Cross-site Scripting (XSS) as classified under CWE-79, in the FolioVision FV Descriptions WordPress plugin (fv-descriptions). This issue affects all versions from n/a through 1.4 inclusive.
The vulnerability carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L). Unauthenticated attackers can exploit it remotely with low complexity by tricking users into performing actions such as clicking a malicious link or interacting with reflected input on a vulnerable site. Exploitation allows limited impacts on confidentiality, integrity, and availability within a changed scope, typically executing arbitrary scripts in the context of the victim's browser session.
Mitigation details are available in the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/fv-descriptions/vulnerability/wordpress-fv-descriptions-plugin-1-4-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve.
Details
- CWE(s)