Medium severity · published Apr 15, 2024
CVE-2024-32429
WordPress Remove Footer Credit plugin <= 1.0.13 - Cross Site Scripting (XSS) vulnerability
4.8
CVSS
0.3%
EPSS
No
On KEV
Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPChill Remove Footer Credit allows Stored XSS.This issue affects Remove Footer Credit: from n/a through 1.0.13.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 27% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RF
Remove Footer Credit · WPChill
through 1.0.13 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-32429
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-32429
Third Party Advisory
https://patchstack.com/database/vulnerability/remove-footer-credit/wordpress-remove-footer-credit-plugin-1-0-13-cross-site-scripting-xss-vulnerability?_s_id=cve
More from Remove Footer Credit
5.4
CVE-2021-24446
The Remove Footer Credit WordPress plugin before 1.0.6 does not have CSRF check in place when saving its settings, which could allow attacker to make logged in admins change them…
4.8
CVE-2021-25050
The Remove Footer Credit WordPress plugin before 1.0.11 does properly sanitise its settings, allowing high privilege users to perform Cross-Site Scripting attacks even when the…