CVE-2024-6447highCWE-79

CVE-2024-6447: high-severity vulnerability in fullservices FULL – Cliente

FULL <= 3.1.12 - Unauthenticated Stored Cross-Site Scripting via License Plan Parameter

Published · Updated

Follow this CVE+ Monitor FULL – Cliente

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.2epss 0.5%
The FULL – Cliente plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the license plan parameter in all versions up to, and including, 3.1.12 due to insufficient input sanitization and output escaping as well as missing authorization and capability checks on the related functions. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that will execute whenever an administrative user accesses wp-admin dashboard
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Affected products
fullservices · FULL – Cliente
Related CVEs — fullservices FULL – Cliente

In the same product, most dangerous first.

CVE-2023-4243HIGHFULL - Customer <= 2.2.3 - Authenticated(Subscriber+) Improper Authorization to Arbitrary Plugin InstallationEPSS 0.9%CVE-2023-4242MEDIUMFULL - Customer <= 2.2.3 - Authenticated(Subscriber+) Information Disclosure via Health CheckEPSS 0.5%CVE-2024-12023MEDIUMFULL – Cliente 3.1.5 - 3.1.25 - Authenticated (Subscriber+) SQL InjectionEPSS 0.4%CVE-2024-9211MEDIUMFULL – Cliente <= 3.1.22 - Reflected Cross-Site ScriptingEPSS 0.4%