VDB
CVE-2024-13406
CVE-2024-13406
PUBLISHED
CVSS 6.099999904632568 MEDIUM
The XML for Google Merchant Center plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'feed_id' parameter in all versions up to, and including, 3.0.11 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
EPSS 0.29% · 21.9th percentile
Risk Scores
CVSS 3.1
6.099999904632568
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS Score
0.29%
21.9th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| icopydoc | xml_for_google_merchant_center | 0, 0 |
| icopydoc | XML for Google Merchant Center | *, 0 |
Timeline
- Jan 22, 2025 CVE Published
- Jan 22, 2025 PoC Published
- Jan 22, 2025 PoC Published
- Jan 22, 2025 PoC Published
- Jan 22, 2025 PoC Published
- Jan 23, 2025 EPSS Score
- Feb 8, 2025 EPSS Score
- Feb 20, 2025 Coalition ESS Score
- Feb 23, 2025 EPSS Score
- Mar 26, 2025 EPSS Score
- Mar 29, 2025 EPSS Score
- Mar 30, 2025 EPSS Score
References
- https://www.wordfence.com/threat-intel/vulnerabilities/id/070f66ae-65aa-4670-8b69-103070a000a4?source=cve url
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3226403%40xml-for-google-merchant-center&new=3226403%40xml-for-google-merchant-center&sfp_email=&sfph_mail= url
- https://nvd.nist.gov/vuln/detail/CVE-2024-13406 advisory