CVE-2024-11975

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

The Reactflow Visitor Recording and Heatmaps plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the '_wpnonce' parameter in all versions up to, and including, 1.0.10 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Dec 21, 2024
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-119767.3The The BuddyPress plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 14.3.3. This is CVE-2024-119777.3The The kk Star Ratings – Rate Post & Collect User Feedbacks plugin for WordPress is vulnerable to arbitrary shortcode execution in all vers CVE-2024-119787.5DreamMaker from Interinfo has a Path Traversal vulnerability, allowing unauthenticated remote attackers to exploit this vulnerability to rea CVE-2024-119799.8DreamMaker from Interinfo has a Path Traversal vulnerability and does not restrict the types of uploaded files. This allows unauthenticated CVE-2024-11989.8A vulnerability, which was classified as critical, was found in openBI up to 6.0.3. Affected is the function addxinzhi of the file applicati CVE-2024-119808.6Certain modes of routers from Billion Electric have a Missing Authentication vulnerability, allowing unauthenticated remote attackers to dir CVE-2024-119817.5Certain models of routers from Billion Electric has an Authentication Bypass vulnerability, allowing unautheticated attackers to retrive con CVE-2024-119827.2Certain models of routers from Billion Electric has a Plaintext Storage of a Password vulnerability. Remote attackers with administrator pri CVE-2024-119837.2Certain models of routers from Billion Electric has an OS Command Injection vulnerability, allowing remote attackers with administrator priv CVE-2024-119848.8A unrestricted upload of file with dangerous type vulnerability in epaper draft function in Corporate Training Management System before 10.1 CVE-2024-119854.4An improper input validation vulnerability leads to device crashes in certain ASUS router models. Refer to the '12/03/2024 ASUS Router Impr CVE-2024-119869.6Improper input handling in the 'Host Header' allows an unauthenticated attacker to store a payload in web application logs. When an Administ