CVE-2024-56296
Published: 07 January 2025
Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kitae Park Mang Board WP mangboard allows Reflected XSS.This issue affects Mang Board WP: from n/a through <= 1.8.4.
Security Summary
CVE-2024-56296 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Reflected Cross-site Scripting (XSS) under CWE-79, in the Mang Board WP plugin for WordPress developed by Kitae Park. This issue affects the plugin from unknown initial versions through version 1.8.4 inclusive.
The vulnerability carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating network accessibility, low attack complexity, no required privileges, and user interaction such as visiting a malicious link. Remote attackers can exploit it by tricking authenticated or unauthenticated users into interacting with crafted input reflected in web pages, achieving arbitrary JavaScript execution in the victim's browser context with changed scope and low impacts to confidentiality, integrity, and availability.
Mitigation details are available in advisories such as the Patchstack database entry at https://patchstack.com/database/Wordpress/Plugin/mangboard/vulnerability/wordpress-mang-board-wp-plugin-1-8-4-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve.
Details
- CWE(s)