CVE-2024-11685

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

The `Kudos Donations – Easy donations and payments with Mollie` plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of `add_query_arg` without appropriate escaping on the URL in all versions up to, and including, 3.2.9. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute if they can successfully trick a user into performing an action, such as clicking on a specially crafted link.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Nov 28, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-116866.1The WhatsApp 🚀 click to chat plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'manycontacts_code' parameter in a CVE-2024-116876.1The Next-Cart Store to WooCommerce Migration plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter i CVE-2024-116886.1The LaTeX2HTML plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'ver' or 'date' parameter in all versions up to,CVE-2024-116898.8The HQ Rental Software plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5.29. This i CVE-2024-11697.5The Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) plugin for WordPress CVE-2024-116906.1The Financial Stocks & Crypto Market Data Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'e' parameter CVE-2024-116918.8Certain WebGL operations on Apple silicon M series devices could have lead to an out-of-bounds write and memory corruption due to a flaw in CVE-2024-116924.3An attacker could cause a select dropdown to be shown over another tab; this could have led to user confusion and possible spoofing attacks.CVE-2024-116939.8The executable file warning was not presented when downloading .library-ms files. *Note: This issue only affected Windows operating system CVE-2024-116946.1Enhanced Tracking Protection's Strict mode may have inadvertently allowed a CSP `frame-src` bypass and DOM-based XSS through the Google Safe CVE-2024-116955.4A crafted URL containing Arabic script and whitespace characters could have hidden the true origin of the page, resulting in a potential spo CVE-2024-116965.4The application failed to account for exceptions thrown by the `loadManifestFromFile` method during add-on signature verification. This flaw