CVE-2024-3615: Media Library Folders <= 8.2.0 - Reflected Cross-Site Scripting via 's'
The Media Library Folders plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in all versions up to, and including, 8.2.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-3615?
CVE-2024-3615 has a severity rating that indicates it allows unauthenticated attackers to exploit reflected cross-site scripting.
How do I fix CVE-2024-3615?
To mitigate CVE-2024-3615, update the Media Library Folders plugin to version 8.2.1 or later to ensure proper input sanitization and output escaping.
Who is affected by CVE-2024-3615?
CVE-2024-3615 affects all versions of the Media Library Folders plugin for WordPress up to and including 8.2.0.
What types of attacks can CVE-2024-3615 enable?
CVE-2024-3615 can enable attacks that allow injection of arbitrary web scripts through the 's' parameter.
Is user authentication required to exploit CVE-2024-3615?
No, CVE-2024-3615 can be exploited by unauthenticated attackers, making it particularly risky.