Lucene search

ThiennvPATCHSTACK:8A829EBDCC27653BDD0B93568BDAFBA2

HistoryFeb 02, 2024 - 12:00 a.m.

WordPress Biteship Plugin <= 2.2.24 is vulnerable to Cross Site Scripting (XSS)

2024-02-0200:00:00

thiennv

patchstack.com

wordpress

biteship

plugin

vulnerable

cross site scripting

injection

cve-2024-24866

patch

medium

owasp top 10

unauthenticated

CVSS3

7.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

AI Score

6.5

Confidence

High

JSON

Software

Biteship

Type

Plugin

Vulnerable versions

<= 2.2.24

Fixed in

2.2.25

OWASP Top 10

A3: Injection

Classification

Cross Site Scripting (XSS)

CVE

CVE-2024-24866

Patch priority

Medium

CVSS severity

Medium (7.1)

Developer

Claim ownership

PSID

138291b61ab9

Credits

thiennv thiennv

Required privilege

Unauthenticated

Published

2 February, 2024

Expand full details Have additional information or questions about this entry? Let us know.

Solution

We advise to mitigate or resolve the vulnerability immediately.

Affected configurations

Vulners

Node

biteshipbiteshipRange≤2.2.24

VendorProductVersionCPE
biteshipbiteship*cpe:2.3:a:biteship:biteship:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
biteship	biteship	*	cpe:2.3:a:biteship:biteship::::::::

References

wordpress.org/plugins/biteship/#developers

www.cve.org/CVERecord?id=CVE-2024-24866