CVE-2024-37253: WordPress WPDirectoryKit plugin <= 1.3.6 - HTML Injection vulnerability
Published Jul 9, 2024
·Updated
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in WpDirectoryKit WP Directory Kit allows Code Injection.This issue affects WP Directory Kit: from n/a through 1.3.6.
Affected Software
3 affected components
wpdirectorykit Wp Directory Kit Wordpress<1.3.7
wpdirectorykit WP Directory Kit<=1.3.6
WordPress WPDirectoryKit<=1.3.6
Remediation
Information
Update to 1.3.7 or a higher version.
Event History
Jul 9, 2024
CVE Published
via MITRE·10:05 AM
Data Sourced
via MITRE·10:05 AM
RemedyDescriptionSeverityWeakness
Data Sourced
via NVD·10:15 AM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2024-37253?
CVE-2024-37253 has a high severity rating due to its potential for code injection.
2
How do I fix CVE-2024-37253?
To fix CVE-2024-37253, update the WP Directory Kit to version 1.3.7 or higher.
3
What are the potential impacts of CVE-2024-37253?
The potential impacts of CVE-2024-37253 include unauthorized code execution and compromise of the website.
4
Which versions of WP Directory Kit are affected by CVE-2024-37253?
CVE-2024-37253 affects WP Directory Kit versions up to and including 1.3.6.
5
Is CVE-2024-37253 specific to any CMS?
Yes, CVE-2024-37253 specifically affects the WP Directory Kit plugin used in WordPress.