Platform
wordpress
Component
all-in-one-redirection
Fixed in
2.2.1
CVE-2024-37245 identifies a Reflected Cross-Site Scripting (XSS) vulnerability within the All In One Redirection plugin for WordPress. This flaw allows attackers to inject malicious scripts into web pages viewed by other users, potentially leading to account compromise or data theft. The vulnerability impacts versions of All In One Redirection up to and including 2.2.0, with a fix available in version 2.2.1.
An attacker exploiting this Reflected XSS vulnerability can inject arbitrary JavaScript code into a user's browser when they visit a specially crafted URL. This code can then be used to steal cookies, redirect users to malicious websites, or deface the website. The impact is particularly severe as XSS vulnerabilities can be used to bypass authentication and gain unauthorized access to user accounts. Successful exploitation could lead to sensitive data exposure, including user credentials and personal information stored within the WordPress environment. The blast radius extends to all users who interact with the affected plugin and visit malicious URLs.
CVE-2024-37245 was publicly disclosed on 2024-07-22. There are currently no known public exploits or active campaigns targeting this vulnerability, but the ease of exploitation makes it a potential target. The vulnerability is not listed on the CISA KEV catalog as of this writing. Public proof-of-concept code is likely to emerge given the straightforward nature of Reflected XSS vulnerabilities.
Exploit Status
EPSS
0.27% (51% percentile)
CISA SSVC
CVSS Vector
The primary mitigation for CVE-2024-37245 is to immediately upgrade the All In One Redirection plugin to version 2.2.1 or later. If upgrading is not immediately feasible due to compatibility issues or breaking changes, consider implementing input validation and output encoding on any user-supplied data used in redirection URLs. Web Application Firewalls (WAFs) configured to detect and block XSS payloads can also provide a temporary layer of protection. After upgrading, verify the fix by attempting to inject a simple JavaScript payload into a redirection URL and confirming that it is properly sanitized.
Update the All In One Redirection plugin to the latest available version. The XSS vulnerability exists in versions equal to or earlier than 2.2.0. The update will correct this vulnerability.
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2024-37245 is a Reflected XSS vulnerability affecting All In One Redirection versions up to 2.2.0, allowing attackers to inject malicious scripts via crafted URLs.
You are affected if you are using All In One Redirection version 2.2.0 or earlier. Check your plugin version and upgrade immediately.
Upgrade All In One Redirection to version 2.2.1 or later to resolve the vulnerability. Consider WAF rules as a temporary measure if upgrading is not immediately possible.
As of now, there are no confirmed reports of active exploitation, but the vulnerability's ease of exploitation makes it a potential target.
Refer to the official All In One Redirection website and WordPress plugin repository for the latest security advisory and update information.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.