CVE-2024-9220

🗓️ 01 Oct 2024 08:30:16Reported by WordfenceType

The LH Copy Media File plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.08. Unauthenticated attackers can inject arbitrary web scripts

Reporter	Title	Published	Views	Family All 12
Circl	CVE-2024-9220	1 Oct 202411:54	–	circl
CNNVD	WordPress plugin LH Copy Media File 跨站脚本漏洞	1 Oct 202400:00	–	cnnvd
Cvelist	CVE-2024-9220 LH Copy Media File <= 1.08 - Reflected Cross-Site Scripting	1 Oct 202408:30	–	cvelist
EUVD	EUVD-2024-49800	3 Oct 202520:07	–	euvd
NVD	CVE-2024-9220	1 Oct 202409:15	–	nvd
OSV	CVE-2024-9220	1 Oct 202409:15	–	osv
Patchstack	WordPress LH Copy Media File plugin <= 1.08 - Reflected Cross-Site Scripting vulnerability	1 Oct 202403:55	–	patchstack
Patchstack	WordPress LH Copy Media File Plugin <= 1.08 is vulnerable to Cross Site Scripting (XSS)	1 Oct 202400:00	–	patchstack
Positive Technologies	PT-2024-39499 · WordPress · Lh Copy Media File	1 Oct 202400:00	–	ptsecurity
RedhatCVE	CVE-2024-9220	23 May 202510:37	–	redhatcve

NVD

Vulners

Node

petershaw lh_copy_media_fileRange<1.09wordpress

[
  {
    "vendor": "shawfactor",
    "product": "LH Copy Media File",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "1.08",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
plugins	www.plugins.trac.wordpress.org/changeset/3160187/
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/9911e99e-0b3b-4be1-b8cd-28593b6d12ad
plugins	www.plugins.trac.wordpress.org/browser/lh-copy-media-file/trunk/lh-copy-media-file.php

08 Apr 2026 18:22Current

6.3Medium risk

Vulners AI Score6.3

CVSS 3.16.1

EPSS0.02577

SSVC

CWE-79