4.8med
CVE-2024-1663
Ultimate Noindex Nofollow Tool II < 1.3.6 - Admin+ Stored XSS
Published 17 mo ago · modified 4 mo ago · JSON
CVSS
4.8
v3.1 · CNA
CISA KEV
No
not known exploited
EPSS
0.3%
percentile 26%
Public exploits
0
none known
Summary
The Ultimate Noindex Nofollow Tool II WordPress plugin before 1.3.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CISA SSVC assessment
- Exploitation
- Proof of concept public
- Automatable
- no
- Technical impact
- partial
- Assessed
- 17 mo ago
Exploit prediction (EPSS)
0.33% probability of exploitation in the next 30 days, higher than 26% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| CISA ADP | 3.1 | 4.8 | CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N |
| CNA | 3.1 | 4.8 | CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N |
Affected products
- Unknown Ultimate Noindex Nofollow Tool II
Classification
- Weakness
- CWE-79 Improper Neutralization of Input During Web Page Generation
References
- wpscan.com /vulnerability/6d101f2b-e903-4e64-92cc-e550abb52d6f/ · exploit, vdb-entry, technical-description
Sources
- CVE List: CVE-2024-1663
- NVD: CVE-2024-1663
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.