CVE-2024-4977: Index WP MySQL For Speed < 1.4.18 - Admin+ Reflected XSS

Severity: medium (CVSS 6.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2024-07-13 · updated 2026-06-17
Weakness: CWE-79

Description

The Index WP MySQL For Speed WordPress plugin before 1.4.18 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin

Affected products

Index WP MySQL For Speed: before 1.4.18 — fixed in 1.4.18

How to fix

Upgrade to a fixed version: Index WP MySQL For Speed 1.4.18. Check the vendor advisory for mitigations.

References

https://wpscan.com/vulnerability/89791a80-5cff-4a1a-8163-94b5be4081a5/
https://wpscan.com/vulnerability/89791a80-5cff-4a1a-8163-94b5be4081a5/

Get alerted when CVE-2024-4977 or the next vulnerability affects your stack