CVE-2024-47624

The BSK Forms Blacklist plugin for WordPress versions from n/a through 3.8.1 contains a reflected cross-site scripting (XSS) vulnerability. This is caused by improper neutralization of user input during web page generation, enabling an attacker to inject arbitrary scripts into a page.

Exploitation requires user interaction: a privileged user (such as an administrator) must click a malicious link, visit a crafted page, or submit a specially prepared form. The attacker does not need prior authentication but relies on tricking an authenticated user into performing the action [1].

If successfully exploited, the injected script could perform actions like redirecting visitors, displaying advertisements, or injecting other HTML payloads into the site, potentially compromising the integrity of the site's content for all visitors [1].

The vulnerability has been patched in version 3.9 of the plugin. Users are advised to update immediately. Patchstack has also issued a mitigation rule to block attacks until the update can be applied [1].