CVE-2024-11458

🗓️ 28 Nov 2024 08:47:34Reported by WordfenceType

The FAQ Builder AYS plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'ays_faq_tab' parameter in all versions up to, and including, 1.7.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link

Reporter	Title	Published	Views	Family All 11
Circl	CVE-2024-11458	28 Nov 202409:05	–	circl
CNNVD	WordPress plugin FAQ Builder AYS 跨站脚本漏洞	28 Nov 202400:00	–	cnnvd
Cvelist	CVE-2024-11458 FAQ Builder AYS <= 1.7.1 - Reflected Cross-Site Scripting	28 Nov 202408:47	–	cvelist
EUVD	EUVD-2024-34024	3 Oct 202520:07	–	euvd
NVD	CVE-2024-11458	28 Nov 202409:15	–	nvd
Patchstack	WordPress FAQ Builder AYS plugin <= 1.7.1 - Reflected Cross-Site Scripting vulnerability	27 Nov 202422:19	–	patchstack
Patchstack	WordPress FAQ Builder AYS Plugin <= 1.7.1 is vulnerable to Cross Site Scripting (XSS)	27 Nov 202400:00	–	patchstack
Positive Technologies	PT-2024-17009 · WordPress · Faq Builder Ays Plugin	28 Nov 202400:00	–	ptsecurity
RedhatCVE	CVE-2024-11458	23 May 202506:45	–	redhatcve
Vulnrichment	CVE-2024-11458 FAQ Builder AYS <= 1.7.1 - Reflected Cross-Site Scripting	28 Nov 202408:47	–	vulnrichment

Vulners

Node

ays-pro faq_builder_aysRange≤1.7.1wordpress

[
  {
    "vendor": "ays-pro",
    "product": "FAQ Builder AYS",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "1.7.1",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
plugins	www.plugins.trac.wordpress.org/browser/faq-builder-ays/tags/1.7.1/admin/partials/faq-builder-ays-admin-actions.php
plugins	www.plugins.trac.wordpress.org/browser/faq-builder-ays/tags/1.7.2/admin/partials/faq-builder-ays-admin-actions.php
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/c509345b-441f-474d-ad3a-720801859f86
plugins	www.plugins.trac.wordpress.org/browser/faq-builder-ays/tags/1.7.0/admin/partials/faq-builder-ays-admin-actions.php

15 Apr 2026 00:35Current

6Medium risk

Vulners AI Score6

CVSS 3.16.1

EPSS0.0092

SSVC

CWE-79