Lucene search
Bob MatyasWPVDB-ID:6CF90A27-55E2-4B2C-9DF1-5FA34C1BD9D1HistoryMay 14, 2024 - 12:00 a.m.
FS Product Inquiry <= 1.1.1 - Reflected XSS
2024-05-1400:00:00
Bob Matyas
wpscan.com
3
plugin
reflected cross-site scripting
parameter sanitization
Description The plugin does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin or unauthenticated users
PoC
Have any user (admin or unauthenticated) open an HTML page with the following:
Related
nvd
nvd
CVE-2024-4856
2024-06-04 06:15:12
cvelist
cvelist
CVE-2024-4856 FS Product Inquiry <= 1.1.1 - Reflected XSS
2024-06-04 06:00:03
vulnrichment
vulnrichment
CVE-2024-4856 FS Product Inquiry <= 1.1.1 - Reflected XSS
2024-06-04 06:00:03
cve
cve
CVE-2024-4856
2024-06-04 06:15:12
wpexploit
wpexploit
FS Product Inquiry <= 1.1.1 - Reflected XSS
2024-05-14 00:00:00
wordfence
wordfence
AI Score
8.6
Confidence
High
EPSS
0
Percentile
9.0%
Related for WPVDB-ID:6CF90A27-55E2-4B2C-9DF1-5FA34C1BD9D1