CVE-2024-55864

Cross-site scripting vulnerability exists in My WP Customize Admin/Frontend versions prior to ver 1.24.1. If a malicious administrative user customizes the administrative page with some malicious contents, an arbitrary script may be executed on the web browser of the other users who are accessing the page.

CVSS v3 4.8 MEDIUM

4.8^/10

CVSS v3 : MEDIUM

Vector : AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Exploitability : 1.7 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://jvn.jp/en/vu/JVNVU90748215/
https://mywpcustomize.com/update-history-my-wp-customize-admin-frontend-1-24-1/
https://wordpress.org/plugins/my-wp/#developers

Configurations

No configuration.

History

No history.

Information

Published : 2024-12-17 05:15

Updated : 2026-06-17 08:11

NVD link : CVE-2024-55864

Mitre link : CVE-2024-55864

CVE.ORG link : CVE-2024-55864

JSON object : View

Products Affected

No product.

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2024-55864", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-55864", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2024-12-17T14:43:47.259861Z"}}], "cvssMetricV30": [{"type": "Secondary", "source": "vultures@jpcert.or.jp", "cvssData": {"scope": "CHANGED", "version": "3.0", "baseScore": 4.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 1.7}]}, "affected": [{"source": "vultures@jpcert.or.jp", "affectedData": [{"vendor": "gqevu6bsiz", "product": "My WP Customize Admin/Frontend", "versions": [{"status": "affected", "version": "prior to ver 1.24.1"}]}]}], "published": "2024-12-17T05:15:09.937", "references": [{"url": "https://jvn.jp/en/vu/JVNVU90748215/", "source": "vultures@jpcert.or.jp"}, {"url": "https://mywpcustomize.com/update-history-my-wp-customize-admin-frontend-1-24-1/", "source": "vultures@jpcert.or.jp"}, {"url": "https://wordpress.org/plugins/my-wp/#developers", "source": "vultures@jpcert.or.jp"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "vultures@jpcert.or.jp", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Cross-site scripting vulnerability exists in My WP Customize Admin/Frontend versions prior to ver 1.24.1. If a malicious administrative user customizes the administrative page with some malicious contents, an arbitrary script may be executed on the web browser of the other users who are accessing the page."}, {"lang": "es", "value": "Existe una vulnerabilidad de Cross-Site Scripting en las versiones de My WP Customize Admin/Frontend anteriores a la 1.24.1. Si un usuario administrativo malintencionado personaliza la p\u00e1gina administrativa con alg\u00fan contenido malintencionado, se puede ejecutar una secuencia de comandos arbitraria en el navegador web de los dem\u00e1s usuarios que acceden a la p\u00e1gina."}], "lastModified": "2026-06-17T08:11:23.443", "sourceIdentifier": "vultures@jpcert.or.jp"}