Vulnerability · Published Sep 6, 2024 · Assigned by WPScan
CVE-2024-6792WP ULike < 4.7.2.1 - Subscriber+ Stored-XSS
Low 3.5
In plain English
A low-severity security flaw in WP ULike from Unknown. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 32% of all known vulnerabilities).
Severity (CVSS 3.1)3.5Low
Exploit odds (30 days)0.4%top 68.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
The WP ULike WordPress plugin before 4.7.2.1 does not properly sanitize user display names when rendering on a public page.
Affected products (as reported)
References
- https://wpscan.com/vulnerability/3c470edd-4b9b-461e-839f-f3a87f0060aa/ exploit, vdb-entry, technical-description