CVE-2024-56035
Published: 02 January 2025
Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kurt Payne Upload Scanner upload-scanner allows Reflected XSS.This issue affects Upload Scanner: from n/a through <= 1.2.
Security Summary
CVE-2024-56035 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Reflected Cross-site Scripting (XSS) under CWE-79, in the Kurt Payne Upload Scanner (upload-scanner) WordPress plugin. This issue affects all versions of the plugin from its initial release through 1.2 inclusive. The vulnerability was published on 2025-01-02 with a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L).
Attackers can exploit this vulnerability remotely over the network with low complexity and no required privileges, though it requires user interaction such as clicking a malicious link. Upon successful exploitation, attackers achieve low impacts on confidentiality, integrity, and availability, with a changed scope that elevates the overall severity.
Patchstack provides details on this Reflected XSS vulnerability in the WordPress Upload Scanner plugin version 1.2 via their database advisory at https://patchstack.com/database/Wordpress/Plugin/upload-scanner/vulnerability/wordpress-upload-scanner-plugin-1-2-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve.
Details
- CWE(s)