CVE-2024-8965

Absolute Reviews <= 1.1.3 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Criteria Name

The Absolute Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Name' field of a custom post criteria in all versions up to, and including, 1.1.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

We have discovered 453 live websites that are affected by CVE-2024-8965.

Run a Free Instant Scan



Affected Software

Product  Absolute Reviews
Category Wordpress Plugins
Vulnerable Domains453 live websites (27% of Absolute Reviews install base)
Vulnerable Versions
  • from 0 through 1.1.3
Vulnerable Versions Count9 versions ( 75% of all versions)


Common Weakness Enumeration

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')



Details

  • Published - Sep 27, 2024
  • Updated - Sep 27, 2024

Credits

  • Muhammad Adel (finder)

Website Distribution by Country

Number of websites using CVE-2024-8965
United States130 websites


Poland83 websites
Germany43 websites
France27 websites
Cyprus15 websites
Italy15 websites
Netherlands13 websites
GB12 websites
Russia11 websites
Vietnam10 websites

Website Distribution by TLD

Number of websites using CVE-2024-8965
.com173 websites
.pl72 websites
.org26 websites
.de15 websites
.net12 websites
.ru10 websites
.nl9 websites
.it7 websites
.ca6 websites
.fr5 websites

Vulnerable Versions

Vulnerable versions are highlighted in red

Websites affected by CVE-2024-8965

Top websites that are affected by CVE-2024-8965. Please click on the "Contact us" link to get more information.
DomainCountryRankContacts
*****************.org United States***,***
***********.com United States***,***
*******.*******.net United States***,***
********.com Italy***,***
*******.com France***,***
*************.com United States***,***
**********.***.uk GB***,***
********.com United States***,***
********.com India***,***
************.com United States***,***
See full domain list

FAQ

CVE-2024-8965 is Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Absolute Reviews
A total of 453 websites have been identified as vulnerable to CVE-2024-8965, based on global website indexing conducted by WebTechSurvey.
The Absolute Reviews is affected by the CVE-2024-8965 vulnerability.
Absolute Reviews versions up to and including 1.1.3 are vulnerable to CVE-2024-8965.