CVE-2024-12626: AutomatorWP <= 5.0.9 - Reflected Cross-Site Scripting via a-0-o-search_field_value
The AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘a-0-o-searchfieldvalue’ parameter in all versions up to, and including, 5.0.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. When used in conjunction with the plugin's import and code action feature, this vulnerability can be leveraged to execute arbitrary code.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-12626?
CVE-2024-12626 has a medium severity rating due to the potential for reflected cross-site scripting attacks.
How do I fix CVE-2024-12626?
To fix CVE-2024-12626, update the AutomatorWP – Automator plugin to version 5.1.0 or later.
What specific vulnerability does CVE-2024-12626 exploit?
CVE-2024-12626 exploits a reflected cross-site scripting vulnerability via the 'a-0-o-search_field_value' parameter.
Which versions of AutomatorWP – Automator are affected by CVE-2024-12626?
All versions of AutomatorWP – Automator up to and including 5.0.9 are affected by CVE-2024-12626.
Can CVE-2024-12626 be exploited remotely?
Yes, CVE-2024-12626 can be exploited remotely as it does not require authentication.