CVE-2024-8734

🗓️ 13 Sep 2024 15:10:42Reported by WordfenceType

The Lucas String Replace plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to improper URL escaping in all versions up to 2.0.5

Reporter	Title	Published	Views	Family All 11
Circl	CVE-2024-8734	13 Sep 202417:57	–	circl
CNNVD	WordPress plugin Lucas String Replace 跨站脚本漏洞	13 Sep 202400:00	–	cnnvd
Cvelist	CVE-2024-8734 Lucas String Replace <= 2.0.5 - Reflected Cross-Site Scripting	13 Sep 202415:10	–	cvelist
EUVD	EUVD-2024-49383	3 Oct 202520:07	–	euvd
NVD	CVE-2024-8734	13 Sep 202415:15	–	nvd
Patchstack	WordPress Lucas String Replace plugin <= 2.0.5 - Reflected Cross-Site Scripting vulnerability	13 Sep 202406:31	–	patchstack
Patchstack	WordPress Lucas String Replace Plugin <= 2.0.5 is vulnerable to Cross Site Scripting (XSS)	13 Sep 202400:00	–	patchstack
Positive Technologies	PT-2024-39212 · WordPress · Lucas String Replace	13 Sep 202400:00	–	ptsecurity
RedhatCVE	CVE-2024-8734	23 May 202507:18	–	redhatcve
Vulnrichment	CVE-2024-8734 Lucas String Replace <= 2.0.5 - Reflected Cross-Site Scripting	13 Sep 202415:10	–	vulnrichment

NVD

Vulners

Node

lucasstad lucas_string_replaceRange≤2.0.5wordpress

[
  {
    "vendor": "lucasstad",
    "product": "Lucas String Replace",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "2.0.5",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/cf1e4b20-e7e5-4a3a-9895-02d51499d54e
plugins	www.plugins.trac.wordpress.org/browser/lucas-string-replace/trunk/includes/class-lucas-string-replace-settings.php

08 Apr 2026 17:24Current

6.3Medium risk

Vulners AI Score6.3

CVSS 3.16.1

EPSS0.01989

SSVC

CWE-79