CVE-2024-7769 is a Stored Cross-Site Scripting (XSS) vulnerability affecting the ClickSold IDX WordPress plugin up to version 1.90. This flaw allows high-privilege users, such as administrators, to inject malicious scripts into website settings due to insufficient input sanitization and escaping. The vulnerability has a CVSS score of 4.8 (Medium), indicating a network-based attack with low complexity, requiring user interaction, and resulting in low impact to confidentiality and integrity. While the attack requires high privileges, it can bypass restrictions like disabled unfiltered_html, particularly in multisite environments. Currently, there is no evidence of active exploitation, nor is public exploit code available in Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage for this CVE are minimal, suggesting a low level of public awareness or concern at this time.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 1.90CPE matchmatch criteria | cpe:2.3:a:clicksold:clicksold_idx:*:*:*:*:*:wordpress:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.