CVE-2024-12595: Mitchelllevy Ahathat

Medium severity, CVSS 4.7. EPSS: 0.3% chance of exploitation in the next 30 days.

The AHAthat Plugin WordPress plugin through 1.6 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers

Affected products

• Mitchelllevy Ahathat: up to and including 1.6

Published 2025-01-02. Last modified 2026-06-17.