CVE-2024-8486

Shortcodes and extra features for Phlox theme <= 2.16.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Modern Heading and Icon Picker Widgets

The Shortcodes and extra features for Phlox theme plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter in the Modern Heading and Icon Picker widgets all versions up to, and including, 2.16.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

We have discovered 7,424 live websites that are affected by CVE-2024-8486.

Test my site



Affected Software

Product  Auxin Elements
Category Wordpress Plugins
Vulnerable Domains7,424 live websites (55.18% of Auxin Elements install base)
Vulnerable Versions
  • from 0 through 2.16.3
Vulnerable Versions Count125 versions ( 94.70% of all versions)


Common Weakness Enumeration

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')



Details

  • Published - Oct 5, 2024
  • Updated - Oct 7, 2024

Credits

  • Craig Smith (finder)

CVE-2024-8486 usage by Country

United States2,030 websites


Germany934 websites
France422 websites
Cyprus369 websites
Poland313 websites
GB237 websites
Brazil236 websites
Spain212 websites
Netherlands212 websites
Russia204 websites

CVE-2024-8486 usage by TLD

.com3,063 websites
.com.br382 websites
.de287 websites
.pl259 websites
.org215 websites
.nl210 websites
.it178 websites
.ru169 websites
.net144 websites
.co.uk137 websites

Vulnerable Versions

Vulnerable versions are highlighted in red

Websites affected by CVE-2024-8486

Top websites that are affected by CVE-2024-8486. Please click on the "Contact us" link to get more information.
DomainCountryRankContacts
***************.fr France**,***
**********.**********.org Germany***,***
*********.com United States***,***
***********.net Spain***,***
*********.com United States***,***
********.net Germany***,***
************.in Germany***,***
*********.com Singapore***,***
**************.com United States***,***
**********.com Iran***,***
See full domain list

FAQ

CVE-2024-8486 is Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Auxin Elements
A total of 7,424 websites have been identified as vulnerable to CVE-2024-8486, discovered through global website indexing conducted by WebTechSurvey.
Auxin Elements is susceptible to CVE-2024-8486 vulnerability.
Auxin Elements versions before, and including, 2.16.3 are vulnerable to CVE-2024-8486.