Vulnerability · Published Apr 18, 2024 · Assigned by Patchstack
CVE-2024-32553WordPress Superfly Menu plugin <= 5.0.25 - Subscriber+ Site-Wide Stored Cross Site Scripting (XSS) vulnerability
High 7.1
In plain English
A high-severity cross-site scripting in Superfly Menu from looks_awesome. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 44% of all known vulnerabilities).
Severity (CVSS 3.1)7.1High
Exploit odds (30 days)0.5%top 56.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in looks_awesome Superfly Menu superfly-menu.This issue affects Superfly Menu: from n/a through <= 5.0.25.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| looks_awesome | Superfly Menu | 0 – through 5.0.25 |
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
References
- https://patchstack.com/database/Wordpress/Plugin/superfly-menu/vulnerability/wordpress-superfly-menu-plugin-5-0-25-subscriber-site-wide-stored-cross-site-scripting-xss-vulnerability?_s_id=cve vdb-entry
- https://patchstack.com/database/vulnerability/superfly-menu/wordpress-superfly-menu-plugin-5-0-25-subscriber-site-wide-stored-cross-site-scripting-xss-vulnerability?_s_id=cve vdb-entry, x_transferred