CVE-2024-6224

Published: Jul 30, 2024Modified: Jun 17, 2026

5.9

Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L

Exploitability: 1.7 / Impact: 3.7

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

The Send email only on Reply to My Comment WordPress plugin through 1.0.6 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack

Affected (1)

Products: Yasirwazir: Send Email Only On Reply To My Comment

1 product

Send Email Only On Reply To My Comment

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Yasirwazir Send Email Only On Reply To My Comment	Up to 1.0.6

Related CWEs

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (2)

https://wpscan.com/vulnerability/54457f1b-6572-4de0-9100-3433c715c5ce/

Source: contact@wpscan.com

ExploitThird Party Advisory

https://wpscan.com/vulnerability/54457f1b-6572-4de0-9100-3433c715c5ce/

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

Timeline

No history available yet.