CVE-2024-11107

System Dashboard < 2.8.15 - Unauthenticated Stored XSS

The System Dashboard WordPress plugin before 2.8.15 does not sanitise and escape some parameters when outputting them in the page, which could allow unauthenticated users to perform Cross-Site Scripting attacks.

Affected

System Dashboard

CVSS v3.1 CNA

6.1 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.34% chance of exploitation in the next 30 days, 26th percentile

Published

2024-12-10

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/a89f1117-8df3-417b-b54f-6587545833ee/

Security advisories

• https://wpscan.com/vulnerability/a89f1117-8df3-417b-b54f-6587545833ee

References

• CVE Record
• NVD entry