CVE-2024-9830

🗓️ 19 Nov 2024 12:45:32Reported by WordfenceType

The Bard theme for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.216. Unauthenticated attackers can inject arbitrary web scripts in pages if they trick a user into performing an action

Reporter	Title	Published	Views	Family All 11
Circl	CVE-2024-9830	19 Nov 202412:51	–	circl
CNNVD	WordPress plugin Bard 跨站脚本漏洞	19 Nov 202400:00	–	cnnvd
Cvelist	CVE-2024-9830 Bard <= 2.216 - Reflected Cross-Site Scripting via add_query_arg Parameter	19 Nov 202412:45	–	cvelist
EUVD	EUVD-2024-49818	3 Oct 202520:07	–	euvd
NVD	CVE-2024-9830	19 Nov 202413:15	–	nvd
Patchstack	WordPress Bard Theme <= 2.216 is vulnerable to Cross Site Scripting (XSS)	19 Nov 202400:00	–	patchstack
Patchstack	WordPress Bard theme <= 2.216 - Reflected Cross-Site Scripting via add_query_arg Parameter vulnerability	19 Nov 202401:08	–	patchstack
Positive Technologies	PT-2024-39872 · WordPress · The Bard Theme For Wordpress	19 Nov 202400:00	–	ptsecurity
RedhatCVE	CVE-2024-9830	23 May 202506:40	–	redhatcve
Vulnrichment	CVE-2024-9830 Bard <= 2.216 - Reflected Cross-Site Scripting via add_query_arg Parameter	19 Nov 202412:45	–	vulnrichment

Vulners

Node

wproyal bardRange≤2.216wordpress

[
  {
    "vendor": "wproyal",
    "product": "Bard",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "2.216",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
themes	www.themes.trac.wordpress.org/browser/bard/2.216/functions.php
themes	www.themes.trac.wordpress.org/browser/bard/2.216/functions.php
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/9aff1e5b-2f16-43d0-b75a-c07e59a9c15f
wordpress	www.wordpress.org/themes/bard/
themes	www.themes.trac.wordpress.org/changeset/248854/

15 Apr 2026 00:35Current

6.1Medium risk

Vulners AI Score6.1

CVSS 3.16.1

EPSS0.0261

SSVC

CWE-79