CVE-2024-12595
AHAthat Plugin <= 1.6 - Reflected XSS via REQUEST_URI
MEDIUM 4.7EPSS 0.3%
The AHAthat Plugin WordPress plugin through 1.6 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers
- Affected
- AHAthat Plugin
- CVSS v3.1 CNA
- 4.7 MEDIUM
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N - EPSS
- 0.33% chance of exploitation in the next 30 days, 24th percentile
- Published
- 2025-01-02
- Updated
- 2025-01-06