CVE-2024-13363: Raptive Ads <= 3.6.3 - Reflected Cross-Site Scripting
First published: Wed Feb 19 2025(Updated: )
The Raptive Ads plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'poc' parameter in all versions up to, and including, 3.6.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Credit: security@wordfence.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Raptive Ads | <=3.6.3 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://www.wordfence.com/threat-intel/vulnerabilities/id/f3d535b3-ad52-4322-988e-7d560dbfe3a3?source=cve
- https://plugins.trac.wordpress.org/browser/adthrive-ads/trunk/components/static-files/partials/eyereturn/eyereturn.html
- https://plugins.trac.wordpress.org/browser/adthrive-ads/trunk/components/static-files/partials/eyereturn
Frequently Asked Questions
What is the severity of CVE-2024-13363?
CVE-2024-13363 is considered a high severity vulnerability due to its potential for reflected cross-site scripting attacks.
How do I fix CVE-2024-13363?
To fix CVE-2024-13363, update the Raptive Ads plugin to the latest version beyond 3.6.3 where the vulnerability is patched.
What is the impact of CVE-2024-13363?
The impact of CVE-2024-13363 allows unauthenticated attackers to inject malicious scripts via the 'poc' parameter.
Which versions are affected by CVE-2024-13363?
All versions of the Raptive Ads plugin up to and including version 3.6.3 are affected by CVE-2024-13363.
Is CVE-2024-13363 exploitable without authentication?
Yes, CVE-2024-13363 is exploitable by unauthenticated users, making it a significant risk.
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/title
- agent/first-publish-date
- agent/type
- agent/description
- agent/references
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- agent/softwarecombine
- collector/nvd-api
- source/NVD
- agent/author
- agent/last-modified-date
- agent/severity
- agent/source
- agent/tags
- agent/event
- vendor/raptive
- canonical/raptive ads