Cross-site scripting in draftpress Follow Us Badges
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.
Summary
The Follow Us Badges plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpsite_follow_us_badges shortcode in all versions up to, and including, 3.1.10 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| draftpress | Follow Us Badges | up to 3.1.10 | — | No fix listed | CNA |
- Follow Us Badges Vendordraftpress Affected up to 3.1.10 Fixed in — No fix listed CNA
CPE names CISA-ADP · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:wpsitenet:follow_us_badges:*:*:*:*:*:*:*:* | — | — | — |
- cpe:2.3:a:wpsitenet:follow_us_badges:*:*:*:*:*:*:*:* Versions — — ·—
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2024-3280
- 2026-10-03 Alias added: GHSA-p7qx-x6gw-cw9m
References
More draftpress vulnerabilities
- TI-2021-07073 Header Footer Code Manager < 1.1.14 - Admin+ SQL Injections CVSS 3.1HIGH 7.2
- TI-2023-20881 WordPress Header Footer Code Manager Plugin <= 1.1.34 is vulnerable to Cross Site Request Forgery (CSRF) CVSS 3.1HIGH 8.8
- TI-2022-00624 Header Footer Code Manager <= 1.1.16 Reflected XSS CVSS 3.1MEDIUM 6.1
- TI-2022-00803 Header Footer Code Manager < 1.1.24 - Reflected Cross-Site Scripting CVSS 3.1MEDIUM 6.1
- TI-2021-06735 My Site Audit <= 1.2.4 - Authenticated Stored Cross-Site Scripting (XSS) CVSS 3.1MEDIUM 5.5
Sources
- CVE-2024-3280 · CVE Program
- CVE-2024-3280 · NVD
- FIRST EPSS
- GHSA-p7qx-x6gw-cw9m · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences