CVE-2024-6708

Description

The User Profile Builder WordPress plugin before 3.12.2 does not sanitise and escape some parameters before outputting its content on the admin area, which allows Admin+ users to perform Cross-Site Scripting attacks.

Reserved 2024-07-11 | Published 2025-05-15 | Updated 2025-05-20 | Assigner WPScan

Problem types

CWE-79 Cross-Site Scripting (XSS)

Product status

Default status
unaffected

Any version before 3.12.2
affected

Credits

John Castro finder

WPScan coordinator

References

wpscan.com/...rability/b6822bd9-f9f9-41a4-ad19-019b1f03bd4c/ exploit vdb-entry technical-description

cve.org (CVE-2024-6708)

nvd.nist.gov (CVE-2024-6708)

Download JSON