WordPress Plugin Vulnerabilities

AHAthat Plugin <= 1.6 - Reflected XSS via REQUEST_URI

Description

The plugin does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers

Proof of Concept

Affects Plugins

Plugin icon
ahathat
No known fix

References

CVE
CVE-2024-12595

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
4.2 (medium)

Miscellaneous

Original Researcher
Bob Matyas
Submitter
Bob Matyas
Submitter website
https://www.bobmatyas.com
Submitter twitter
bobmatyas
Verified
Yes
WPVDB ID
7a506438-3106-477f-816d-b9b116ec8555

Timeline

Publicly Published
2024-12-12 (about 1 year ago)
Added
2024-12-13 (about 1 year ago)
Last Updated
2024-12-13 (about 1 year ago)

Other

Published
Title
Published
2015-07-13
Title
Plotly <= 1.0.2 - Authenticated Stored Cross-Site Scripting (XSS)
Published
2025-09-26
Title
User Notes <= 1.0.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
Published
2024-03-25
Title
Frontend Dashboard < 2.2.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting
Published
2021-11-01
Title
GenerateBlocks < 1.4.0 - Contributor+ Stored Cross-Site Scripting
Published
2014-08-01
Title
vkontakte-api - vkontakte-api/swf/tagcloud.swf tagcloud Parameter XSS