Lucene search
HistorySep 12, 2024 - 6:15 a.m.
CVE-2024-8056
wordpress plugin
reflected cross-site scripting
$_server['request_uri'] parameter
CVSS3
6.1
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS
0.001
Percentile
17.7%
The MM-Breaking News WordPress plugin through 0.7.9 does not escape the $_SERVER[‘REQUEST_URI’] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers
Affected configurations
Node
mm-breaking_news_projectmm-breaking_newsRange≤0.7.9wordpress
| Vendor | Product | Version | CPE |
|---|---|---|---|
| mm-breaking_news_project | mm-breaking_news | * | cpe:2.3:a:mm-breaking_news_project:mm-breaking_news:*:*:*:*:*:wordpress:*:* |
Related
cvelist
cvelist
CVE-2024-8056 MM-Breaking News <= 0.7.9 - Reflected XSS
2024-09-12 06:00:07
cve
cve
CVE-2024-8056
2024-09-12 06:15:25
vulnrichment
vulnrichment
CVE-2024-8056 MM-Breaking News <= 0.7.9 - Reflected XSS
2024-09-12 06:00:07
wordfence
wordfence
CVSS3
6.1
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS
0.001
Percentile
17.7%
Related for NVD:CVE-2024-8056