CVE-2024-58305 — WonderCMS 4.3.2 Cross-Site Scripting Remote Code Execution via Module Installation
WonderCMS 4.3.2 contains a cross-site scripting vulnerability that allows attackers to inject malicious JavaScript through the module installation endpoint. Attackers can craft …
Published: 2025-12-12 · CVSS: 8.6 · CVSS 4.0
WonderCMS 4.3.2 contains a cross-site scripting vulnerability that allows attackers to inject malicious JavaScript through the module installation endpoint. Attackers can craft a specially designed XSS payload to install a reverse shell module and execute remote commands by tricking an authenticated administrator into accessing a malicious link.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7