Lucene search

K
patchstackFrancesco CarlucciPATCHSTACK:FC34077D689F55CC0DE27E42A62F2C0B
HistoryOct 09, 2024 - 12:00 a.m.

WordPress Shortcodes AnyWhere Plugin <= 1.0.1 is vulnerable to Content Injection

2024-10-0900:00:00
Francesco Carlucci
patchstack.com
4
content injection
wordpress
plugin
vulnerable
cve-2024-9581
medium severity
unauthenticated

CVSS3

7.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

AI Score

6.8

Confidence

High

EPSS

0.001

Percentile

17.9%

Software

Shortcodes AnyWhere

Type

Plugin

Vulnerable versions

<= 1.0.1

Fixed in

N/A

OWASP Top 10

A3: Injection

Classification

Content Injection

CVE

CVE-2024-9581

Patch priority

Medium

CVSS severity

Medium (7.3)

Developer

Claim ownership

PSID

9c5d59c3c6ea

Credits

Francesco Carlucci

Required privilege

Unauthenticated

Published

9 October, 2024

Vulnerability details

Remove and replace plugin Expand full details Have additional information or questions about this entry? Let us know.

Solution

We advise to mitigate or resolve the vulnerability immediately.

Affected configurations

Vulners
Node
-shortcodes_anywhereRange1.0.1
VendorProductVersionCPE
-shortcodes_anywhere*cpe:2.3:a:-:shortcodes_anywhere:*:*:*:*:*:*:*:*

CVSS3

7.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

AI Score

6.8

Confidence

High

EPSS

0.001

Percentile

17.9%

Related for PATCHSTACK:FC34077D689F55CC0DE27E42A62F2C0B