CVE-2024-9835: RSS Feed Widget < 3.0.1 - Reflected XSS
Published Nov 12, 2024
·Updated
The RSS Feed Widget WordPress plugin before 3.0.1 does not escape the $SERVER['REQUESTURI'] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers
Affected Software
2 affected components
WordPress RSS Feed Widget<3.0.1
Fahadmahmood Rss Feed Widget Wordpress<3.0.1
Event History
Nov 12, 2024
CVE Published
via MITRE·06:00 AM
Data Sourced
via MITRE·06:00 AM
DescriptionWeakness
Data Sourced
via NVD·06:15 AM
DescriptionSeverity
Frequently Asked Questions
1
What is the severity of CVE-2024-9835?
CVE-2024-9835 is classified as a high severity vulnerability due to its potential for Reflected Cross-Site Scripting attacks.
2
How do I fix CVE-2024-9835?
To fix CVE-2024-9835, update the WordPress RSS Feed Widget plugin to version 3.0.1 or later.
3
What versions of the WordPress RSS Feed Widget are affected by CVE-2024-9835?
CVE-2024-9835 affects all versions of the WordPress RSS Feed Widget plugin before 3.0.1.
4
What type of vulnerability is CVE-2024-9835?
CVE-2024-9835 is a Reflected Cross-Site Scripting vulnerability caused by improper output escaping.
5
Which parameter is exploited in CVE-2024-9835?
CVE-2024-9835 exploits the $_SERVER['REQUEST_URI'] parameter in the WordPress RSS Feed Widget.