CVE Database /
CVE-2024-9204
CVE · Medium
CVE-2024-9204 — Smart Custom 404 Error Page [404page] < 11.4.8
| CVE |
Vulnerability |
Type |
Severity |
Affected |
Fixed in |
Published |
Status |
|
CVE-2024-9204
|
Smart Custom 404 Error Page [404page] < 11.4.8 |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') |
Medium
6.1
|
< 11.4.8
|
11.4.8 |
2024-10-03 |
—
|
CVE-2024-9204
The Smart Custom 404 Error Page plugin for WordPress contains a flaw allowing malicious code injection through the REQUEST_URI server variable, which is not properly sanitized or escaped in versions up to and including 11.4.7. This vulnerability enables unauthenticated attackers to inject arbitrary scripts into pages that are executed when users click on specific links, potentially leading to unauthorized actions.
Based on public CVE data (MITRE/NVD).
Scan your WordPress site free
No signup, no credit card — enter your URL and get a security report in seconds.
See the full security page for this plugin
Browse the CVE database
Browse all security findings