CVE-2024-7133

The Floating Notification Bar, Sticky Menu on Scroll, Announcement Banner, and Sticky Header for Any WordPress plugin before 2.7.3 does not validate and escape some of its settings before outputting them back in the page, which could allow users with a high role to perform Stored Cross-Site Scripting attacks.

CVSS v3 4.8 MEDIUM

4.8^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.7 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://wpscan.com/vulnerability/c81c1622-33d1-41f2-ba63-f06bd4c125ab/	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:premio:my_sticky_bar:*:*:*:*:*:wordpress:*:*

History

No history.

Information

Published : 2024-09-13 06:15

Updated : 2024-09-27 21:27

NVD link : CVE-2024-7133

Mitre link : CVE-2024-7133

CVE.ORG link : CVE-2024-7133

JSON object : View

Products Affected

premio

my_sticky_bar

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2024-7133", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 4.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 1.7}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 4.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 1.7}]}, "published": "2024-09-13T06:15:15.580", "references": [{"url": "https://wpscan.com/vulnerability/c81c1622-33d1-41f2-ba63-f06bd4c125ab/", "tags": ["Exploit", "Third Party Advisory"], "source": "contact@wpscan.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "The Floating Notification Bar, Sticky Menu on Scroll, Announcement Banner, and Sticky Header for Any WordPress plugin before 2.7.3 does not validate and escape some of its settings before outputting them back in the page, which could allow users with a high role to perform Stored Cross-Site Scripting attacks."}, {"lang": "es", "value": "El complemento Floating Notification Bar, Sticky Menu on Scroll, Announcement Banner, and Sticky Header for Any de WordPress anterior a 2.7.3 no validan ni escapan algunas de sus configuraciones antes de mostrarlas nuevamente en la p\u00e1gina, lo que podr\u00eda permitir que los usuarios con un rol alto realicen ataques de Cross-site Scripting almacenado."}], "lastModified": "2024-09-27T21:27:50.053", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:premio:my_sticky_bar:*:*:*:*:*:wordpress:*:*", "vulnerable": true, "matchCriteriaId": "B3BA279A-E35B-4C35-8B2C-DE4089E05D66", "versionEndExcluding": "2.7.3"}], "operator": "OR"}]}], "sourceIdentifier": "contact@wpscan.com"}