CVE-2024-42758

5.4 mediumEPSS 0.8%

Medium (5.4). EPSS 0.8% chance of exploitation in the next 30 days.

A Cross-site Scripting (XSS) vulnerability exists in version v2024-01-05 of the indexmenu plugin when is used and enabled in Dokuwiki (Open Source Wiki Engine). A malicious attacker can input XSS payloads for example when creating or editing existing page, to trigger the XSS on Dokuwiki, which is then stored in .txt file (due to nature of how Dokuwiki is designed), which presents stored XSS.

Severity

CVSS 3.1

5.4 medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

EPSS: 0.8% chance of exploitation in the next 30 days; higher than 55% of CVEs (scores of 2026-10-31)
CWE: CWE-79
Published: 2024-08-16
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

References

https://github.com/1s1ldur/CVE-2024-42758/blob/main/README.md
https://github.com/dokuwiki/dokuwiki
https://github.com/samuelet/indexmenu
https://github.com/samuelet/indexmenu/issues/317

Check your stack JSON