CVE-2024-37436

Vulnerability

Overview

The Uncanny Toolkit Pro for LearnDash plugin is vulnerable to a reflected Cross-Site Scripting (XSS) vulnerability due to improper neutralization of user-supplied input during webpage generation. This issue affects versions before 4.1.4.1 [1].

Exploitation

Exploitation requires user interaction, where a privileged user must click a malicious link or visit a crafted page. Attackers can host the malicious link remotely and trick an authenticated administrator into clicking it, leading to script execution. The CVSS score of 7.1 reflects the need for user interaction and the potential for impact [1].

Impact

Successful exploitation could allow an attacker to inject arbitrary HTML and JavaScript into the victim's browser session. This could be used to perform actions such as redirecting visitors, displaying advertisements, or stealing sensitive data like authentication cookies [1].

Mitigation

The vulnerability is patched in version 4.1.4.1. Users are strongly advised to update immediately. Patchstack has also provided a virtual mitigation rule to block attacks until the update is applied [1].