CVE-2024-56056
Published: 07 January 2025
Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in kmfoysal06 SimpleCharm simplecharm allows Reflected XSS.This issue affects SimpleCharm: from n/a through <= 1.4.3.
Security Summary
CVE-2024-56056 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Reflected Cross-site Scripting (CWE-79), in the SimpleCharm WordPress theme developed by kmfoysal06. This flaw affects SimpleCharm versions from n/a through 1.4.3.
Attackers can exploit this vulnerability remotely over the network (AV:N) with low complexity (AC:L), no privileges required (PR:N), but it requires user interaction (UI:R), such as clicking a malicious link. Successful exploitation changes scope (S:C) and allows low-impact effects on confidentiality, integrity, and availability (C:L/I:L/A:L), enabling arbitrary script execution in the context of the targeted user's browser.
The Patchstack advisory at https://patchstack.com/database/Wordpress/Theme/simplecharm/vulnerability/wordpress-simplecharm-theme-1-4-3-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve documents the Reflected XSS vulnerability in SimpleCharm version 1.4.3 and provides details for practitioners on affected installations.
Details
- CWE(s)