CVE-2024-21504: Versions of the package livewire/livewire from 3.3.5 and before 3.4.9 are vulnerable to Cross-site Scripting (XSS) when a page uses [Url] for a property. An…

PriorityP425medium6.1CVSS 3.1

AVNACLPRNUIRSCCLILAN

EPSS

0.52%

40.0th percentile

Versions of the package livewire/livewire from 3.3.5 and before 3.4.9 are vulnerable to Cross-site Scripting (XSS) when a page uses [Url] for a property. An attacker can inject HTML code in the context of the user's browser session by crafting a malicious link and convincing the user to click on it.

Affected

3 ranges

Vendor	Product	Version range	Fixed in
laravel	livewire	3.3.5 – 3.4.9	—
livewire	livewire	>= 3.3.5 < 3.4.9	3.4.9
livewire	livewire	>= 3.3.5 < 3.4.9	3.4.9

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.