Lucene search

WPScanVULNRICHMENT:CVE-2024-6020

HistorySep 04, 2024 - 6:00 a.m.

CVE-2024-6020 Sign-up Sheets < 2.2.13 - Reflected XSS

2024-09-0406:00:02

WPScan

github.com

cve-2024-6020

sign-up sheets

wordpress plugin

reflected xss

AI Score

6.8

Confidence

High

EPSS

Percentile

9.6%

SSVC

Exploitation

poc

Automatable

Technical Impact

partial

JSON

The Sign-up Sheets WordPress plugin before 2.2.13 does not escape some generated URLs, as well as the $_SERVER[‘REQUEST_URI’] parameter before outputting them back in attributes, which could lead to Reflected Cross-Site Scripting.

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:a:fetchdesigns:sign-up_sheets:*:*:*:*:*:*:*:*"
    ],
    "vendor": "fetchdesigns",
    "product": "sign-up_sheets",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "lessThan": "2.2.13",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unknown"
  }
]

References

wpscan.com/vulnerability/f3526320-3abd-4ddb-8f73-778741bd9c48/