CVE-2024-56065
Published: 13 January 2025
Summary
CVE-2024-56065 is a high-severity Cross-site Scripting (CWE-79) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique JavaScript (T1059.007); ranked at the 36.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Deeper analysis
CVE-2024-56065 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Reflected Cross-site Scripting (XSS) under CWE-79, in the WP2LEADS WordPress plugin developed by Saleswonder Team: Tobias. This issue affects WP2LEADS versions from n/a through 3.4.2 inclusive. The vulnerability was published on 2025-01-13 with a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L).
Attackers can exploit this vulnerability remotely over the network with low attack complexity and no required privileges, though it demands user interaction such as clicking a malicious link. With a changed scope (S:C), exploitation enables limited impacts on confidentiality, integrity, and availability, typically allowing execution of arbitrary scripts in the context of the victim's browser session on the affected WordPress site.
The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/wp2leads/vulnerability/wordpress-wp2leads-plugin-3-4-2-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve provides details on this vulnerability in the WP2LEADS plugin version 3.4.2, recommending mitigation through updating to a patched version beyond 3.4.2.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-52963
Vulnerability details
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Saleswonder Team: Tobias WP2LEADS wp2leads allows Reflected XSS.This issue affects WP2LEADS: from n/a through <= 3.4.2.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Reflected XSS directly enables arbitrary JavaScript execution (T1059.007) in the victim's browser via a crafted malicious link requiring user interaction (T1204.001).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Timely patching of the vulnerable WP2LEADS plugin to a version beyond 3.4.2 directly remediates the reflected XSS flaw as recommended by the advisory.
Validating and sanitizing untrusted inputs before processing prevents malicious scripts from being reflected in dynamically generated web pages by the plugin.
Filtering and encoding information outputs, such as user-supplied data reflected in web pages, blocks arbitrary script execution in victims' browsers.