« Volver al listado

CVE-2024-55864

Estado: AplazadaMedia (4.8)—

Cross-site scripting vulnerability exists in My WP Customize Admin/Frontend versions prior to ver 1.24.1. If a malicious administrative user customizes the administrative page with some malicious contents, an arbitrary script may be executed on the web browser of the other users who are accessing the page.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

MY WP Customize — Admin FrontendAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-55864",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-55864",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-12-17T14:43:47.259861Z"
        }
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Secondary",
        "source": "vultures@jpcert.or.jp",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.0",
          "baseScore": 4.8,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 1.7
      }
    ]
  },
  "affected": [
    {
      "source": "vultures@jpcert.or.jp",
      "affectedData": [
        {
          "vendor": "gqevu6bsiz",
          "product": "My WP Customize Admin/Frontend",
          "versions": [
            {
              "status": "affected",
              "version": "prior to ver 1.24.1"
            }
          ]
        }
      ]
    }
  ],
  "published": "2024-12-17T05:15:09.937",
  "references": [
    {
      "url": "https://jvn.jp/en/vu/JVNVU90748215/",
      "source": "vultures@jpcert.or.jp"
    },
    {
      "url": "https://mywpcustomize.com/update-history-my-wp-customize-admin-frontend-1-24-1/",
      "source": "vultures@jpcert.or.jp"
    },
    {
      "url": "https://wordpress.org/plugins/my-wp/#developers",
      "source": "vultures@jpcert.or.jp"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "vultures@jpcert.or.jp",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Cross-site scripting vulnerability exists in My WP Customize Admin/Frontend versions prior to ver 1.24.1. If a malicious administrative user customizes the administrative page with some malicious contents, an arbitrary script may be executed on the web browser of the other users who are accessing the page."
    },
    {
      "lang": "es",
      "value": "Existe una vulnerabilidad de Cross-Site Scripting en las versiones de My WP Customize Admin/Frontend anteriores a la 1.24.1. Si un usuario administrativo malintencionado personaliza la página administrativa con algún contenido malintencionado, se puede ejecutar una secuencia de comandos arbitraria en el navegador web de los demás usuarios que acceden a la página."
    }
  ],
  "lastModified": "2026-06-17T08:11:23.443",
  "sourceIdentifier": "vultures@jpcert.or.jp"
}