Vulnerability · Published Nov 13, 2024 · Assigned by Wordfence
CVE-2024-10577Fat Rat Collect <= 2.7.3 - Reflected Cross-Site Scripting
Medium 6.1
In plain English
A medium-severity cross-site scripting in 胖鼠采集(Fat Rat Collect) from fbtopcn. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 45% of all known vulnerabilities).
Official description
The 胖鼠采集(Fat Rat Collect) 微信知乎简书腾讯新闻列表分页采集, 还有自动采集、自动发布、自动标签、等多项功能。开源插件 plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to missing escaping on a URL in all versions up to, and including, 2.7.3. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| fbtopcn | 胖鼠采集(Fat Rat Collect) | 0 – through 2.7.3 |
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
References
- https://www.wordfence.com/threat-intel/vulnerabilities/id/664d265b-7b35-4c61-b48b-d051b7fb5ebd?source=cve
- https://wordpress.org/plugins/fat-rat-collect/
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3191188%40fat-rat-collect%2Ftrunk&old=3119807%40fat-rat-collect%2Ftrunk&sfp_email=&sfph_mail=