CVE-2024-11325

Vulnerability

The AWeber Forms by Optin Cat plugin for WordPress is vulnerable to Reflected Cross-Site Scripting (XSS) in versions up to and including 2.5.7. The vulnerability stems from the use of add_query_arg without proper escaping on the URL in the eoi-subscribers.php file [1][2]. An attacker can inject arbitrary web scripts via crafted parameters.

Exploitation

An unauthenticated attacker can craft a malicious link that includes a script payload in the URL parameters. The victim must be tricked into clicking the link, which then executes the injected script in the context of the victim's browser session. No prior authentication or special configuration is required.

Impact

Successful exploitation allows the attacker to execute arbitrary JavaScript in the victim's browser. This can lead to session hijacking, defacement, redirection to malicious sites, or other actions performed within the context of the affected WordPress site.

Mitigation

The plugin developer has released a fix in version 2.5.8, as indicated by the changeset [1]. Users are strongly advised to update to the latest available version immediately. No workaround has been provided for older versions.