CVE-2024-4865

Summary

CVE-2024-4865 is a newly disclosed vulnerability affecting the Happy Addons plugin for WordPress. This issue, which exists in all versions up to 3.10.8, allows authenticated attackers with Contributor-level access or higher to execute stored Cross-Site Scripting (XSS) attacks. The vulnerability arises due to insufficient input sanitization and output escaping of the '_id' parameter. Attackers can exploit this flaw by injecting arbitrary web scripts, which will execute whenever a user visits an injected page, posing a significant security risk.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.