WordPress Plugin Vulnerabilities

PropertyHive < 2.1.1 - Reflected XSS

Description

The plugin does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.

Proof of Concept

Affects Plugins

Plugin icon
propertyhive
Fixed in 2.1.1

References

CVE
CVE-2024-12585

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
7.1 (high)

Miscellaneous

Original Researcher
Hassan Khan Yusufzai - Splint3r7
Submitter
Hassan Khan Yusufzai - Splint3r7
Submitter website
https://hassankhanyusufzai.com
Submitter twitter
Splint3r7
Verified
Yes
WPVDB ID
afecf367-d298-4f4c-8f47-4e19b3937d3e

Timeline

Publicly Published
2024-12-18 (about 1 year ago)
Added
2024-12-18 (about 1 year ago)
Last Updated
2025-08-20 (about 4 months ago)

Other

Published
Title
Published
2023-04-19
Title
White Label Branding for Elementor Page Builder <= 1.0.2 - Admin+ Stored XSS
Published
2024-10-30
Title
Step by Step <= 0.4.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2022-07-07
Title
Copyright Proof <= 4.16 - Reflected Cross-Site-Scripting
Published
2024-05-17
Title
Popup Maker < 1.3.7 - Subscriber+ Stored XSS
Published
2021-09-27
Title
Wappointment < 2.2.5 - Unauthenticated Stored Cross-Site Scripting