CVE-2024-12749
HighPublished
Competition Form <= 2.0 - Reflected XSS
- Published
- Jan 29, 2025
- Updated
- Jan 29, 2025
- Assigning CNA
- WPScan
Primary CVSS
7.1/ 10High
nvd · CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L0.6%
Low · next 30 days
- Percentile
- 46.3%
- Model date
- Sep 21, 2026
EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.
Summary
The Competition Form WordPress plugin through 2.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
Sources
Repository evidence: Files: 1 · Repositories: 1
1 Template
http/cves/2024/CVE-2024-12749.yaml
Nuclei TemplatesDeclared conditions
- network: http($.protocol_keys)
- verification: dsl($.matchers[*].type)
Responsible use
Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.