CVE-2024-35694

Deeper analysis

The vulnerability is an instance of improper neutralization of input during web page generation, specifically a cross-site scripting flaw (CWE-79), present in the WPMobile.App WordPress plugin maintained by Amauri. It affects all versions through 11.41 and carries a CVSS 3.1 base score of 7.1 reflecting network attack vector, low complexity, no required privileges, and required user interaction with changed scope.

An unauthenticated remote attacker can supply crafted input that is rendered in a victim’s browser session. Successful exploitation allows the attacker to execute arbitrary script in the context of the affected site, resulting in limited disclosure or modification of data and potential disruption of service for users who visit the manipulated page.

Public advisories published by Patchstack on 8 June 2024 record the issue and identify the wpappninja component as the affected package; they direct administrators to apply the vendor-supplied update that resolves the input-handling defect. The associated EPSS score reached a peak of 0.1679 and currently stands at 0.1343, indicating moderate and sustained exploitation interest following disclosure.