CVE-2024-56038

CVE-2024-56038 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Reflected Cross-site Scripting (XSS), in the SendSMS WordPress plugin developed by catalinsendsms. The issue affects SendSMS versions from n/a through 1.2.9 and is associated with CWE-79.

Attackers can exploit this vulnerability remotely over the network (AV:N) with low attack complexity (AC:L), requiring no privileges (PR:N) but user interaction (UI:R), such as clicking a malicious link. Exploitation changes the scope (S:C) and results in low impacts to confidentiality, integrity, and availability (C:L/I:L/A:L), with an overall CVSS v3.1 score of 7.1. This enables execution of arbitrary scripts in the victim's browser context, potentially leading to session hijacking or data theft.

The Patchstack advisory provides details on this WordPress SendSMS plugin vulnerability, including assessment and recommended actions for mitigation.