CVE-2024-30461
Published: 05 January 2026
Summary
CVE-2024-30461 is a high-severity Cross-site Scripting (CWE-79) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 22.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Deeper analysis
CVE-2024-30461 is an Improper Neutralization of Input During Web Page Generation vulnerability that enables DOM-Based Cross-Site Scripting (XSS) in the Tumult Hype Animations WordPress plugin from Tumult Inc. The flaw affects all versions of the plugin from n/a through 1.9.11 and is classified under CWE-79 with a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L).
Unauthenticated attackers (PR:N) can exploit this vulnerability remotely over the network (AV:N) with low complexity (AC:L), though it requires user interaction (UI:R) such as clicking a malicious link or performing a specific action. Successful exploitation changes the scope (S:C), allowing limited impacts on confidentiality, integrity, and availability (C:L/I:L/A:L), typically through script injection into the Document Object Model to steal session data or perform actions in the victim's context.
The Patchstack advisory at https://patchstack.com/database/wordpress/plugin/tumult-hype-animations/vulnerability/wordpress-tumult-hype-animations-plugin-1-9-11-csrf-to-xss-vulnerability?_s_id=cve details the vulnerability, including CSRF-to-XSS vectors, and provides guidance for WordPress site administrators on mitigation, such as updating the plugin or applying available patches.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-28382
Vulnerability details
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Tumult Inc Tumult Hype Animations allows DOM-Based XSS.This issue affects Tumult Hype Animations: from n/a through 1.9.11.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
DOM-based XSS in public-facing WordPress plugin directly enables remote exploitation of the web application (T1190) via crafted input leading to script execution in victim browsers.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation and neutralization of untrusted input before it is used in web page generation, blocking the DOM-based XSS payload described in CVE-2024-30461.
Mandates filtering or encoding of information output to web clients, preventing injected scripts from executing in the victim's DOM as exploited by this vulnerability.
Requires mechanisms to detect and block malicious code (including script payloads) delivered via web content, providing secondary mitigation against the unauthenticated XSS vector.