Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.1
CVE-2024-41349: WordPress Plugin Unmark 1.9.2 Allows Malicious Code Execution
CVE-2024-41349 · published 2 years ago
Summary
A security issue in WordPress plugin Unmark allows hackers to inject malicious code into a website, potentially allowing them to steal user data or take control of the site. This is because the plugin does not properly validate user input, which means attackers can exploit it by manipulating the URL. To fix this, update the Unmark plugin to the latest version or remove and reinstall it from a trusted source.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| unmark | unmark |
1.9.2 cpe:2.3:a:unmark:unmark:1.9.2:*:*:*:*:*:*:* |
Original advisory text
unmark 1.9.2 is vulnerable to Cross Site Scripting (XSS) via application/views/marks/add_by_url.php.
unmark 1.9.2 is vulnerable to Cross Site Scripting (XSS) via application/views/marks/add_by_url.php.
References
- https://github.com/cdevroe/unmark/issues/290 Third Party Advisory
- https://github.com/cdevroe/unmark/commit/52342dc4a908dc6ac6878f21a5850108ac84a4b... Patch
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/41xxx/CVE-2024-41349... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2024-41349 Vendor Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published29 Aug 2024
Updated31 Oct 2026
First seen7 Mar 2026
Track software like this
Free during beta