CVE-2024-10825

The Hide My WP Ghost – Security & Firewall plugin contains a reflected cross-site scripting flaw affecting versions 5.3.01 and earlier, allowing unauthenticated attackers to inject malicious scripts through the URL parameter by exploiting inadequate input filtering and output encoding. An attacker could craft a malicious link that, when clicked by an administrator, would execute arbitrary JavaScript in the context of the WordPress site. The vulnerability was fixed in version 5.3.02.

Based on public CVE data (MITRE/NVD).