CVE-2024-13735

MITTEL 5.4CVE-2024-13735 · Published 14/02/2025 · updated 17/06/2026

Kurz gesagt

CVE-2024-13735 ist eine Schwachstelle (MITTEL (CVSS 5.4)) in hurrytimer (hurrytimer).
Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 0.31%, höher als bei 23.7% aller Schwachstellen.
Abhilfe: auf 2.12.0 oder neuer aktualisieren.

Package	Affected versions	Patched versions
hurrytimer hurrytimer	`< 2.12.0`	`2.12.0`

Description

The HurryTimer – An Scarcity and Urgency Countdown Timer for WordPress & WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.11.2 due to insufficient input sanitization and output escaping of a campaign name. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

References

docs.hurrytimer.com/getting-started/creating-a-one-time-campaign · Product
plugins.trac.wordpress.org/changeset/3239755 · Patch
wordpress.org/plugins/hurrytimer · Product
wordfence.com/threat-intel/vulnerabilities/id/a5b247a7-50f4-4d35-b24a-2c788ba0b051 · Third Party Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free