WordPress Plugin Vulnerabilities

Multiple Plugins from CreativeMindsSolutions - Reflected XSS

Description

Multiple plugins from CreativeMindsSolutions are vulnerable to Reflected Cross-Site Scripting via the cminds_free_guide shortcode due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

Affects Plugins

Plugin icon
cm-business-directory
Fixed in 1.4.2
Plugin icon
cm-email-blacklist
Fixed in 1.5.4
Plugin icon
cm-header-footer-script-loader
Fixed in 1.2.2
Plugin icon
cm-on-demand-search-and-replace
Fixed in 1.4.3
Plugin icon
cm-pop-up-banners
Fixed in 1.7.6
Plugin icon
cm-video-lesson-manager
Fixed in 1.8.3
Plugin icon
enhanced-tooltipglossary
Fixed in 4.3.12

References

CVE
CVE-2024-11202
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/db759c60-9ce9-407d-8d1f-cbbfd09759d5

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
7.1 (high)

Miscellaneous

Original Researcher
Peter Thaleikis
Verified
No
WPVDB ID
f47372ad-63b2-49e6-a2c4-954819cae2ca

Timeline

Publicly Published
2024-11-25 (about 1 year ago)
Added
2024-12-02 (about 1 year ago)
Last Updated
2024-12-02 (about 1 year ago)

Other

Published
Title
Published
2023-11-06
Title
SendPress Newsletters < 1.23.11.6 - Contributor+ Stored XSS
Published
2025-01-06
Title
TemplatesNext ToolKit <= 3.2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2021-08-30
Title
Easy Social Icons < 3.0.9 - Reflected Cross-Site Scripting
Published
2020-09-09
Title
Cookiebot < 3.6.1 - CSRF & XSS
Published
2025-10-10
Title
Next Page, Not Next Post <= 0.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting