CVE-2024-58305 - CVE House

Back to Database

Status published High CVE-2024-58305

WonderCMS 4.3.2 Cross-Site Scripting Remote Code Execution via Module Installation

8.6 CVSS

Vulnerability Description

WonderCMS 4.3.2 contains a cross-site scripting vulnerability that allows attackers to inject malicious JavaScript through the module installation endpoint. Attackers can craft a specially designed XSS payload to install a reverse shell module and execute remote commands by tricking an authenticated administrator into accessing a malicious link.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-58305

Check My Exposure

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

prodigiousMind

References

More from wondercms

View All →

A cross-site scripting (XSS) vulnerability in Wondercms v3.3.4 allows attackers...

A remote code execution vulnerability in the installUpdateThemePluginAction function in...

A server-side request forgery (SSRF) vulnerability in the addCustomThemePluginRepository function...

WonderCMS 3.1.3 is affected by cross-site scripting (XSS) in the...

WonderCMS 3.1.3 is affected by cross-site scripting (XSS) in the...

Affected Vendor

wondercms

View all reports →

Affected Software

WonderCMS

Vulnerable Versions:

4.3.2

Timeline

Official Publish: December 12th, 2025

Last Modified: April 7th, 2026

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1189 Drive-by Compromise

T1059.007 JavaScript

T1539 Steal Web Session Cookie

T1213 Data from Information Repositories

T1567 Exfiltration Over Web Service

T1491.001 Defacement