CVE-2024-21752

2024-02-2906:15:47

CWE-352

Patchstack

web.nvd.nist.gov

cve

csrf

ajax search lite

xss

nvd

CVSS3

7.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

EPSS

Percentile

9.0%

JSON

Cross-Site Request Forgery (CSRF) vulnerability in Ernest Marcinko Ajax Search Lite allows Reflected XSS.This issue affects Ajax Search Lite: from n/a through 4.11.4.

Affected configurations

Vulners

Node

ernest_marcinkoajax_search_liteRange≤4.11.4wordpress

VendorProductVersionCPE
ernest_marcinkoajax_search_lite*cpe:2.3:a:ernest_marcinko:ajax_search_lite:*:*:*:*:*:wordpress:*:*

Vendor	Product	Version	CPE
ernest_marcinko	ajax_search_lite	*	cpe:2.3:a:ernest_marcinko:ajax_search_lite::::::wordpress::*

CNA Affected

[
  {
    "collectionURL": "https://wordpress.org/plugins",
    "defaultStatus": "unaffected",
    "packageName": "ajax-search-lite",
    "product": "Ajax Search Lite",
    "vendor": "Ernest Marcinko",
    "versions": [
      {
        "changes": [
          {
            "at": "4.11.5",
            "status": "unaffected"
          }
        ],
        "lessThanOrEqual": "4.11.4",
        "status": "affected",
        "version": "n/a",
        "versionType": "custom"
      }
    ]
  }
]

References

patchstack.com/database/vulnerability/ajax-search-lite/wordpress-ajax-search-lite-plugin-4-11-4-reflected-xss-via-cross-site-request-forgery-csrf-vulnerability?_s_id=cve