CVE-2024-12626: fallo crítico en rubengc AutomatorWP – Automator plugin for…
AutomatorWP <= 5.0.9 - Reflected Cross-Site Scripting via a-0-o-search_field_value
Publicada el · Actualizada el
Seguir esta CVE+ Monitorear AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
28Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 9.6epss 0.7%
The AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘a-0-o-search_field_value’ parameter in all versions up to, and including, 5.0.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. When used in conjunction with the plugin's import and code action feature, this vulnerability can be leveraged to execute arbitrary code.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Productos afectados
rubengc · AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPressCVEs relacionadas — rubengc AutomatorWP – Automator plugin for…
En el mismo producto, de las más peligrosas a las menos.
CVE-2025-9539HIGHAutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress <= 5.3.6 - Missing Authorization To Authenticated (Subscriber+) Remote Code Execution via Automation CreationEPSS 0.5%CVE-2026-76057MEDIUMAutomatorWP <= 5.8.4 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via automatorwp_convertkit_get_forms AJAX ActionEPSS 0.4%CVE-2026-76074MEDIUMAutomatorWP <= 5.8.4 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via automatorwp_campaign_monitor_get_lists AJAX ActionEPSS 0.4%CVE-2025-5487HIGHAutomatorWP <= 5.2.5 - Authenticated (Administrator+) SQL Injection via field_conditionsEPSS 0.4%CVE-2025-9542MEDIUMAutomatorWP <= 5.3.7 - Authenticated (Subscriber+) Missing Authorization to Multiple FunctionsEPSS 0.2%