CVE-2024-8665

🗓️ 13 Sep 2024 06:47:26Reported by WordfenceType

The YITH Custom Login plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to improper URL escaping in all versions up to, and including, 1.7.

Reporter	Title	Published	Views	Family All 13
Circl	CVE-2024-8665	13 Sep 202409:35	–	circl
CNNVD	WordPress plugin YITH Custom Login 跨站脚本漏洞	13 Sep 202400:00	–	cnnvd
Cvelist	CVE-2024-8665 YITH Custom Login <= 1.7.3 - Reflected Cross-Site Scripting	13 Sep 202406:47	–	cvelist
EUVD	EUVD-2024-49335	3 Oct 202520:07	–	euvd
NVD	CVE-2024-8665	13 Sep 202407:15	–	nvd
OSV	BIT-WORDPRESS-2024-8665	17 Sep 202407:25	–	osv
OSV	BIT-WORDPRESS-MULTISITE-2024-8665	17 Sep 202407:24	–	osv
Patchstack	WordPress YITH Custom Login plugin <= 1.7.3 - Reflected Cross-Site Scripting vulnerability	13 Sep 202406:08	–	patchstack
Patchstack	WordPress YITH Custom Login Plugin <= 1.7.3 is vulnerable to Cross Site Scripting (XSS)	13 Sep 202400:00	–	patchstack
Positive Technologies	PT-2024-39163 · Yith · Yith Custom Login	13 Sep 202400:00	–	ptsecurity

NVD

Vulners

Node

yithemes yith_custom_loginRange<1.7.4wordpress

[
  {
    "vendor": "yithemes",
    "product": "YITH Custom Login",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "1.7.3",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/0828a4a4-2dd5-4dff-8563-c81d6b24b949
plugins	www.plugins.trac.wordpress.org/browser/yith-custom-login/tags/1.7.3/yit-common/yith-panel.php
plugins	www.plugins.trac.wordpress.org/changeset
plugins	www.plugins.trac.wordpress.org/changeset

08 Apr 2026 16:34Current

6.2Medium risk

Vulners AI Score6.2

CVSS 3.16.1

EPSS0.01041

SSVC

CWE-79