Vulnerability · Published Feb 8, 2024 · Assigned by Patchstack

CVE-2024-24881WordPress WP SMS Plugin <= 6.5.2 is vulnerable to Cross Site Scripting (XSS)

High 7.1

In plain English

A high-severity cross-site scripting in WP SMS – Messaging & SMS Notification for WordPress, WooCommerce, GravityForms, etc from VeronaLabs. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 32% of all known vulnerabilities).

Severity (CVSS 3.1)7.1High

Exploit odds (30 days)0.4%top 68.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VeronaLabs WP SMS – Messaging & SMS Notification for WordPress, WooCommerce, GravityForms, etc allows Reflected XSS.This issue affects WP SMS – Messaging & SMS Notification for WordPress, WooCommerce, GravityForms, etc: from n/a through 6.5.2.

Affected products (as reported)

Vendor	Product	Versions
VeronaLabs	WP SMS – Messaging & SMS Notification for WordPress, WooCommerce, GravityForms, etc	n/a – through 6.5.2

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

References

https://patchstack.com/database/vulnerability/wp-sms/wordpress-wp-sms-plugin-6-5-2-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve vdb-entry