CVE-2024-6272

CVE-2024-6272 is a Reflected Cross-Site Scripting (XSS) vulnerability affecting the SpiderContacts WordPress plugin up to version 1.1.7. It stems from improper sanitization of a parameter before outputting it, allowing attackers to inject malicious scripts. This medium-severity vulnerability (CVSS 6.1) can be exploited remotely with low complexity, requiring user interaction. A successful attack could lead to information disclosure and integrity compromise, particularly impacting high-privilege users like administrators. There is currently no evidence of active exploitation, nor are there publicly available exploit modules in Metasploit or Nuclei. The vulnerability has received minimal community discussion and media coverage.