CVE-2024-5883 Ultimate Classified Listings < 1.3 - Reflected XSS

2024-07-2906:00:07

WPScan

github.com

cve-2024-5883

ultimate classified listings

wordpress plugin

reflected xss

cross-site scripting

high privilege users

admin

AI Score

6.2

Confidence

High

SSVC

Exploitation

poc

Automatable

Technical Impact

partial

JSON

The Ultimate Classified Listings WordPress plugin before 1.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:a:ultimate-classified-listings:ultimate_classified_listings:*:*:*:*:*:*:*:*"
    ],
    "vendor": "ultimate-classified-listings",
    "product": "ultimate_classified_listings",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "lessThan": "1.3",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unknown"
  }
]