Medium severity · published Nov 26, 2024
CVE-2024-11202
Multiple Plugins <= (Various Versions) - Reflected Cross-Site Scripting via cminds_free_guide Shortcode
6.1
CVSS
0.6%
EPSS
No
On KEV
Description
Multiple plugins for WordPress are vulnerable to Reflected Cross-Site Scripting via the cminds_free_guide shortcode in various versions due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 49% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CB
CM Business Directory – Optimise and showcase local business · creativemindssolutions
through 1.4.1 · source: vendor
CE
CM E-Mail Blacklist – Simple email filtering for safer registration · creativemindssolutions
through 1.5.3 · source: vendor
CH
CM Header and Footer – Add custom scripts and styles to your header and footer with ease · creativemindssolutions
through 1.2.1 · source: vendor
CP
CM Pop-Up – Create engaging popups to capture attention and boost interaction · creativemindssolutions
through 1.7.5 · source: vendor
CS
CM Search And Replace – Optimize content edits with a powerful search and replace tool · creativemindssolutions
through 1.4.2 · source: vendor
CT
CM Tooltip Glossary · creativemindssolutions
through 4.3.11 · source: vendor
CV
CM Video Lessons Manager – Simplify video lessons management for better education · creativemindssolutions
through 1.8.2 · source: vendor
Affected product
CB
CM Business Directory – Optimise and showcase local business
creativemindssolutions
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-11202
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-11202
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/cm-business-directory/trunk/package/cminds-free.php#L1465
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/cm-email-blacklist/trunk/package/cminds-free.php#L1465
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/cm-header-footer-script-loader/trunk/package/cminds-free.php#L1465
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/cm-on-demand-search-and-replace/trunk/package/cminds-free.php#L1469
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/cm-pop-up-banners/trunk/package/cminds-free.php#L1471
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/cm-video-lesson-manager/trunk/package/cminds-free.php#L1465
More from CM Business Directory – Optimise and showcase local business
6.4
CVE-2026-8892
CM Business Directory <= 1.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Business Address Meta Fields
6.4
CVE-2025-10178
CM Business Directory <= 1.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting