CVE-2024-56065

CVE-2024-56065 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Reflected Cross-site Scripting (XSS) under CWE-79, in the WP2LEADS WordPress plugin developed by Saleswonder Team: Tobias. This issue affects WP2LEADS versions from n/a through 3.4.2 inclusive. The vulnerability was published on 2025-01-13 with a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L).

Attackers can exploit this vulnerability remotely over the network with low attack complexity and no required privileges, though it demands user interaction such as clicking a malicious link. With a changed scope (S:C), exploitation enables limited impacts on confidentiality, integrity, and availability, typically allowing execution of arbitrary scripts in the context of the victim's browser session on the affected WordPress site.

The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/wp2leads/vulnerability/wordpress-wp2leads-plugin-3-4-2-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve provides details on this vulnerability in the WP2LEADS plugin version 3.4.2, recommending mitigation through updating to a patched version beyond 3.4.2.