CVE-2024-6529 Ultimate Classified Listings < 1.4 - Reflected XSS

2024-08-0106:00:05

WPScan

github.com

wordpress

xss

reflected cross-site scripting

high privilege users

AI Score

6.1

Confidence

High

SSVC

Exploitation

poc

Automatable

Technical Impact

partial

JSON

The Ultimate Classified Listings WordPress plugin before 1.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin

CNA Affected

[
  {
    "vendor": "Unknown",
    "product": "Ultimate Classified Listings",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "lessThan": "1.4",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:a:webcodingplace:ultimate_classified_listings:*:*:*:*:*:*:*:*"
    ],
    "vendor": "webcodingplace",
    "product": "ultimate_classified_listings",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "lessThan": "1.4",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]