Lucene search

WPScanCVE-2024-7084

HistoryAug 06, 2024 - 6:15 a.m.

CVE-2024-7084

2024-08-0606:15:36

WPScan

web.nvd.nist.gov

ajax search lite

cross-site scripting

wordpress

AI Score

5.8

Confidence

High

EPSS

Percentile

9.5%

JSON

The Ajax Search Lite WordPress plugin before 4.12.1 does not sanitise and escape some parameters, which could allow users with a role as low as Admin+ to perform Cross-Site Scripting attacks.

Affected configurations

Vulners

Node

ajax_search_projectajax_searchRange<4.12.1litewordpress

VendorProductVersionCPE
ajax_search_projectajax_search*cpe:2.3:a:ajax_search_project:ajax_search:*:*:*:*:lite:wordpress:*:*

Vendor	Product	Version	CPE
ajax_search_project	ajax_search	*	cpe:2.3:a:ajax_search_project:ajax_search:::::lite:wordpress::

CNA Affected

[
  {
    "vendor": "Unknown",
    "product": "Ajax Search Lite",
    "versions": [
      {
        "status": "affected",
        "versionType": "semver",
        "version": "0",
        "lessThan": "4.12.1"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

References

wpscan.com/vulnerability/0d38bf4d-de6a-49f8-be69-fa483fa61bb7/