CVE-2024-11447: Community by PeepSo – Social Network, Membership, Registration, User Profiles, Premium – Mobile App <=7.0.3.0 - Reflected Cross-Site Scripting

6.1 CVSS

Description

The Community by PeepSo – Download from PeepSo.com plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘filter’ parameter in all versions up to, and including, 7.0.3.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

Classification

CVE ID: CVE-2024-11447

CVSS Base Severity: MEDIUM

CVSS Base Score: 6.1

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Problem Types

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected Products

Vendor: peepso

Product: Community by PeepSo – Download from PeepSo.com

Exploit Prediction Scoring System (EPSS)

EPSS Score: 0.18% (probability of being exploited)

EPSS Percentile: 40.76% (scored less or equal to compared to others)

EPSS Date: 2025-04-16 (when was this score calculated)

Stakeholder-Specific Vulnerability Categorization (SSVC)

SSVC Exploitation: none

SSVC Technical Impact: partial

SSVC Automatable: false

References

https://nvd.nist.gov/vuln/detail/CVE-2024-11447
https://www.wordfence.com/threat-intel/vulnerabilities/id/049a36b1-4e24-4ac9-a594-9cabdc0dfe0f?source=cve
https://plugins.trac.wordpress.org/browser/peepso-core/trunk/classes/template.php#L68
https://plugins.trac.wordpress.org/browser/peepso-core/tags/6.4.6.2/templates/activity/activity-stream-filters-simple.php#L131
https://plugins.trac.wordpress.org/browser/peepso-core/tags/6.4.6.2/templates/activity/activity-stream-filters.php#L179
https://www.peepso.com/7.0.4.0/

Timeline