CVE-2024-49700
Published: 21 January 2025
Summary
CVE-2024-49700 is a high-severity Cross-site Scripting (CWE-79) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 22.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Deeper analysis
CVE-2024-49700 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Reflected Cross-site Scripting (XSS) under CWE-79, in the ARPrice WordPress plugin developed by reputeinfosystems. The issue affects ARPrice versions from n/a through 4.1.3 inclusive.
With a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), the vulnerability is exploitable over the network with low attack complexity and no required privileges, though it demands user interaction. Remote attackers can trick authenticated or unauthenticated users into interacting with maliciously crafted links or inputs reflected in the plugin's web page generation, enabling script injection in the victim's browser context and achieving low impacts on confidentiality, integrity, and availability alongside a scope change.
Patchstack provides details on the vulnerability in its advisory at https://patchstack.com/database/Wordpress/Plugin/arprice/vulnerability/wordpress-arprice-plugin-4-0-3-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve, which security practitioners should consult for recommended mitigations and patch information.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-43697
Vulnerability details
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in reputeinfosystems ARPrice arprice allows Reflected XSS.This issue affects ARPrice: from n/a through <= 4.1.3.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Reflected XSS in public-facing WordPress plugin directly enables exploitation of T1190 via crafted links; requires user interaction matching T1204.001.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly enforces validation and sanitization of user inputs to prevent improper neutralization exploited in this reflected XSS vulnerability.
Mandates filtering of output prior to display, neutralizing malicious scripts reflected from untrusted inputs in the ARPrice plugin.
Requires timely identification, prioritization, and remediation of the specific flaw in ARPrice versions through 4.1.3 to eliminate the XSS vulnerability.