CVE-2024-3469

GP Premium <= 2.4.0 - Reflected Cross-Site Scripting

CVSS 6.1 MEDIUMEPSS 0.6%◆ VulnCheck KEVCWE-79

Vexday Risk Score

50Attention

SSVC decision (CISA)

Act

Exploitation + impact → act immediately

Exploit maturity

Functional exploit

Automatable exploit available (Nuclei/Metasploit).

CVSS 6.1EPSS 0.6%KEV nãoPoC —Nuclei simMetasploit —Patch —

Lifecycle

05 Jun 2024Published on NVD

Recommendation: Patch as soon as possible — active exploitation confirmed.

The GP Premium plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the message parameter in all versions up to, and including, 2.4.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Affected products

GeneratePress · GP Premium

References

https://generatepress.com/category/changelog/https://www.wordfence.com/threat-intel/vulnerabilities/id/1a697391-f30d-403f-9046-8fa219a49302?source=cve