CVE-2024-29094: WordPress HT Easy GA4 plugin <= 1.1.7 - Cross Site Scripting (XSS) vulnerability

Q: What is the severity of CVE-2024-29094?

CVE-2024-29094 is a high severity vulnerability categorized as stored cross-site scripting (XSS).

Q: How do I fix CVE-2024-29094?

To fix CVE-2024-29094, update the HT Easy GA4 plugin to version 1.1.8 or later.

Q: Which software is affected by CVE-2024-29094?

CVE-2024-29094 affects the HasThemes HT Easy GA4 plugin versions up to and including 1.1.7.

Q: Is CVE-2024-29094 a remote exploit vulnerability?

Yes, CVE-2024-29094 allows remote attackers to execute stored XSS payloads.

Q: What type of vulnerability is CVE-2024-29094?

CVE-2024-29094 is classified as an improper neutralization of input during web page generation, leading to XSS issues.

Published Mar 19, 2024

Updated

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HasThemes HT Easy GA4 ( Google Analytics 4 ) allows Stored XSS.This issue affects HT Easy GA4 ( Google Analytics 4 ): from n/a through 1.1.7.

Affected Software

3 affected components

HasThemes HT Easy GA4<=1.1.7

WordPress HT Easy GA4<=1.1.7

HasThemes Ht Easy Ga4 \(google Analytics 4\) Wordpress<1.1.8

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WordPress HT Easy GA4 to a version that resolves this vulnerability.
Fixed in 1.1.8

Event History

Mar 19, 2024

CVE Published

via MITRE·04:38 PM

Data Sourced

via MITRE·04:38 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·05:15 PM

DescriptionSeverityWeaknessAffected Software

Apr 2, 58713

Event

via FIRST·03:18 AM

Frequently Asked Questions

What is the severity of CVE-2024-29094?

CVE-2024-29094 is a high severity vulnerability categorized as stored cross-site scripting (XSS).

How do I fix CVE-2024-29094?