CVE-2024-0979: Dashboard Widgets Suite <= 3.4.3 - Reflected Cross-Site Scripting
The Dashboard Widgets Suite plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tab' parameter in all versions up to, and including, 3.4.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-0979?
CVE-2024-0979 is considered a medium severity vulnerability due to its potential to allow reflected cross-site scripting attacks.
How do I fix CVE-2024-0979?
To fix CVE-2024-0979, update the Dashboard Widgets Suite plugin to version 3.4.4 or later.
Who is affected by CVE-2024-0979?
All users of the Dashboard Widgets Suite plugin for WordPress prior to version 3.4.4 are affected by CVE-2024-0979.
What types of attacks can CVE-2024-0979 facilitate?
CVE-2024-0979 can facilitate reflected cross-site scripting attacks by exploiting insufficient input sanitization.
Is CVE-2024-0979 an authenticated or unauthenticated vulnerability?
CVE-2024-0979 is an unauthenticated vulnerability, allowing attackers to exploit it without requiring user credentials.