CVE-2024-39125: Roundup-Tracker Roundup

Medium severity, CVSS 5.4. EPSS: 0.3% chance of exploitation in the next 30 days.

Roundup before 2.4.0 allows XSS via a SCRIPT element in an HTTP Referer header.

Affected products

• Roundup-Tracker Roundup: before 2.4.0 (fixed in 2.4.0)

Published 2024-07-17. Last modified 2026-06-17.