VULNERABILITY INTELLIGENCE

CVE-2024-29809

CVSS score5.4 MEDIUM
EPSS probability0.41%
CISA KEVNot currently listed
Published2024-03-26
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Description

The image_url parameter of the AJAX call to the editimage_bwg action of admin-ajax.php is vulnerable to reflected Cross Site Scripting. The value of the image_url parameter is embedded within an existing JavaScript within the response allowing arbitrary JavaScript to be inserted and executed. The attacker must target a an authenticated user with permissions to access this component to exploit this issue.

Weakness classification

  • info@appcheck-ng.com: CWE-79
  • 134c704f-9b21-4f2e-91b3-4a467353bcc0: CWE-79

Primary references