Vulnerability-Lookup - Search a vulnerability

Vulnerabilites related to thehowarde - Parallax Image

CVE-2024-11224 (GCVE-0-2024-11224)

Vulnerability from cvelistv5

Published

2024-11-19 12:45

Modified

2024-11-19 14:01

Severity ?

6.4 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Summary

The Parallax Image plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘position’ parameter in all versions up to, and including, 1.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

References

▼	URL	Tags
	https://www.wordfence.com/threat-intel/vulnerabilities/id/56e5f7c9-ad22-43b3-9bfe-0eea1f8040d3?source=cve
	https://plugins.trac.wordpress.org/browser/parallax-image/tags/1.9/assets/shortcode.php#L156
	https://wordpress.org/plugins/parallax-image/#developers
	https://plugins.trac.wordpress.org/changeset/3189649/

Impacted products

	Vendor	Product	Version
	thehowarde	Parallax Image	Version: * ≤ 1.9

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-11224",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-11-19T13:54:53.156571Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-19T14:01:50.491Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Parallax Image",
          "vendor": "thehowarde",
          "versions": [
            {
              "lessThanOrEqual": "1.9",
              "status": "affected",
              "version": "*",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Peter Thaleikis"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Parallax Image plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u2018position\u2019 parameter in all versions up to, and including, 1.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-11-19T12:45:28.507Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/56e5f7c9-ad22-43b3-9bfe-0eea1f8040d3?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/parallax-image/tags/1.9/assets/shortcode.php#L156"
        },
        {
          "url": "https://wordpress.org/plugins/parallax-image/#developers"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/3189649/"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2024-11-18T23:53:42.000+00:00",
          "value": "Disclosed"
        }
      ],
      "title": "Parallax Image \u003c= 1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via position Parameter"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2024-11224",
    "datePublished": "2024-11-19T12:45:28.507Z",
    "dateReserved": "2024-11-14T20:35:12.147Z",
    "dateUpdated": "2024-11-19T14:01:50.491Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-9898 (GCVE-0-2024-9898)