cbcvebase.
CVE-2024-35694
published 2024-06-08

CVE-2024-35694: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Amauri WPMobile.App wpappninja.This issue affects…

PriorityP180medium6.1CVSS 3.1
AVNACLPRNUIRSCCLILAN
ITWEXPLOITVulnCheck KEV
Exploited in the wild
EPSS
0.67%
47.2th percentile
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Amauri WPMobile.App wpappninja.This issue affects WPMobile.App: from n/a through <= 11.41.

Affected

2 ranges
VendorProductVersion rangeFixed in
amauriwpmobile.app< 11.4211.42
amauriwpmobile.app<= 11.41—

Detection & IOCsextracted from sources · hover to see the quote

url/?wpapp_shortcode="%3E%3Cscript%3Ealert(document.domain)%3C/script%3E&wpappninja_simul4=1↗
path/wp-content/plugins/wpappninja↗
  • →Probe for reflected XSS by sending the `wpapp_shortcode` parameter with a script payload and `wpappninja_simul4=1` query parameter; a vulnerable response will contain `alert(document.domain)` in the HTML body with HTTP 200 and Content-Type text/html. ↗
  • →Detect presence of the vulnerable plugin on a WordPress site by searching for the path `/wp-content/plugins/wpappninja` in HTTP response bodies (Shodan, FOFA, Google dork). ↗
  • →Match the regex `[\s\S]*?alert\(document\.domain\)[\s\S]*?` in the HTTP response body to confirm successful XSS reflection. ↗
  • ·The vulnerability is a reflected XSS (not stored), so exploitation requires the attacker to deliver a crafted URL to the victim; no persistent server-side payload is planted. ↗
  • ·Affected versions are WPMobile.App up to and including 11.41; version 11.42 and above contain the fix (changeset 3082701). ↗

CVSS provenance

nvdv3.16.1MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
vulncheck6.1MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.