VDB
CVE-2024-12820
CVE-2024-12820
PUBLISHED
CVSS 6.400000095367432 MEDIUM
The MK Google Directions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'MKGD' shortcode in all versions up to, and including, 3.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
EPSS 0.23% · 14.1th percentile
Risk Scores
CVSS 3.1
6.400000095367432
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
EPSS Score
0.23%
14.1th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| manoj_rana91986 | MK Google Directions | *, 0 |
| webtamarin | mk_google_directions | 0, 0 |
Timeline
- Feb 28, 2025 Coalition ESS Score
- Feb 28, 2025 CVE Published
- Feb 28, 2025 PoC Published
- Feb 28, 2025 PoC Published
- Mar 1, 2025 EPSS Score
- Mar 2, 2025 PoC Published
- Mar 15, 2025 EPSS Score
- Mar 29, 2025 EPSS Score
- Apr 13, 2025 EPSS Score
- Apr 27, 2025 EPSS Score
- May 11, 2025 EPSS Score
- May 25, 2025 EPSS Score
References
- https://www.wordfence.com/threat-intel/vulnerabilities/id/23b3570c-cd8e-4dec-bbad-6374c44530bd?source=cve url
- https://nvd.nist.gov/vuln/detail/CVE-2024-12820 advisory
- https://plugins.trac.wordpress.org/changeset/3246361/google-distance-calculator/tags/3.1.1/mk-google-directions.php?old=3046209&old_path=google-distance-calculator%2Ftags%2F3.1%2Fmk-google-directions.php url