CVE-2024-42758

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-08-16 · updated 2026-06-17
Weakness: CWE-79

Description

A Cross-site Scripting (XSS) vulnerability exists in version v2024-01-05 of the indexmenu plugin when is used and enabled in Dokuwiki (Open Source Wiki Engine). A malicious attacker can input XSS payloads for example when creating or editing existing page, to trigger the XSS on Dokuwiki, which is then stored in .txt file (due to nature of how Dokuwiki is designed), which presents stored XSS.

Affected products

Andreas Gohr Dokuwiki: 2024-01-05

References

https://github.com/1s1ldur/CVE-2024-42758/blob/main/README.md
https://github.com/dokuwiki/dokuwiki
https://github.com/samuelet/indexmenu
https://github.com/samuelet/indexmenu/issues/317

Get alerted when CVE-2024-42758 or the next vulnerability affects your stack