CVE-2024-3469

Deeper analysis

The GP Premium plugin for WordPress is vulnerable to reflected cross-site scripting via the message parameter in all versions up to and including 2.4.0. The flaw stems from insufficient input sanitization and output escaping, as described under CWE-79, and carries a CVSS 3.1 score of 6.1.

Unauthenticated attackers can exploit the issue by crafting a malicious link that, when clicked by a victim, injects and executes arbitrary web scripts in the context of the affected site. Successful exploitation requires the attacker to trick a user into performing an action such as following the link, resulting in limited impacts to confidentiality and integrity with changed scope.

Advisories and changelog entries are referenced at generatepress.com and Wordfence threat intelligence pages, which practitioners should consult for available updates. The EPSS score reached a peak of 0.1381, indicating some post-disclosure exploitation interest.