CVE-2024-9344: BerqWP – Automated All-In-One PageSpeed Optimization Plugin for Core Web Vitals, Cache, CDN, Images, CSS, and JavaScript <= 2.1.1 - Reflected Cross-Site Scripting
First published: Wed Oct 02 2024(Updated: )
The BerqWP – Automated All-In-One PageSpeed Optimization Plugin for Core Web Vitals, Cache, CDN, Images, CSS, and JavaScript plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'url' parameter in all versions up to, and including, 2.1.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Credit: security@wordfence.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| WordPress | <2.1.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://www.wordfence.com/threat-intel/vulnerabilities/id/01d5e5b5-033c-4690-9857-3339e2831340?source=cve
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3160806%40searchpro&new=3160806%40searchpro&sfp_email=&sfph_mail=
- https://plugins.trac.wordpress.org/browser/searchpro/trunk/simplehtmldom/example/scraping/example_scraping_general.php?rev=3138385
Frequently Asked Questions
What is the severity of CVE-2024-9344?
CVE-2024-9344 has a medium severity level due to its potential for exploiting reflected cross-site scripting.
How do I fix CVE-2024-9344?
To fix CVE-2024-9344, update the BerqWP plugin to version 2.1.2 or later.
What versions are affected by CVE-2024-9344?
CVE-2024-9344 affects all versions of BerqWP up to and including 2.1.1.
What type of vulnerability is CVE-2024-9344?
CVE-2024-9344 is classified as a reflected cross-site scripting (XSS) vulnerability.
Is my WordPress site safe if I use BerqWP after updating for CVE-2024-9344?
Yes, your WordPress site should be safe from the reflected XSS attack once you update the BerqWP plugin to the patched version.
- agent/weakness
- agent/references
- agent/title
- agent/first-publish-date
- agent/description
- agent/type
- agent/severity
- agent/author
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/remedy
- agent/softwarecombine
- agent/event
- agent/trending
- agent/epss
- collector/epss-latest
- source/FIRST
- agent/source
- agent/tags
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/berqier
- canonical/wordpress