CVE-2024-43216 MEDIUM

CVE-2024-43216: WordPress Filr plugin <= 1.2.4 - Cross Site Scripting (XSS) vulnerability

Vendor Wp Chill

Product Filr

Weakness CWE-79 · XSS

Published August 12, 2024

Last update April 28, 2026

View on NVD All CVEs

CVSS base score

6.5/10

Attack vector Network

Attack complexity Low

Privileges required Low

User interaction Required

Confidentiality Low

Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

What the vulnerability does

01Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Filr filr-protection.This issue affects Filr: from n/a through <= 1.2.4.

Explanation of Vulnerability in Simple Terms

02Summary

Filr versions up to 1.2.4 contain a cross-site scripting (XSS) vulnerability that allows an authenticated attacker to inject malicious scripts. The vulnerability requires user interaction—typically a victim clicking a crafted link—and can affect other users or the site itself. The impact is limited to reading or modifying non-sensitive data.

What an attacker can do

03Attacker Capabilities

Inject malicious scripts that execute in other users' browsers when they visit a crafted page.

Potential impact on your site

04Site Impact

Users' sessions or data could be compromised if they interact with attacker-crafted content; site reputation may be affected.

Conditions required to exploit

05Prerequisites

Attacker must have a user account on the site; victim must click a malicious link or visit an attacker-controlled page.

Key dates

06Disclosure timeline

August 12, 2024 CVE published

April 28, 2026 Record updated

External resources

07References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2024-43216 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/79.html AskarLabs — CWE-79 write-up Cross-Site Scripting

Related vulnerabilities