CVE-2024-43264

HIGH

Insertion of Sensitive Information Into Sent Data vulnerability in mischiefmarmot Create by Mediavine mediavine-create.This issue affects Create by Mediavine: from n/a through <= 1.9.8.

Affects 1 product across 1 vendor.

CVSS 3.17.5
EPSS0.4%
Percentile29th
PatchUnknown
CVSS Vector — Plain English Remotely exploitable over the network, low complexity, no authentication required, no user interaction needed, impact contained to the vulnerable component, full confidentiality impact, no integrity impact, no availability impact.
CWE Weakness Definitions
CWE-201: CWE-201
Related Attack Patterns (CAPEC)
CAPEC-612 WiFi MAC Address Tracking
via CWE-201
CAPEC-613 WiFi SSID Tracking
via CWE-201
CAPEC-618 Cellular Broadcast Message Request
via CWE-201
CAPEC-619 Signal Strength Tracking
via CWE-201
CAPEC-621 Analysis of Packet Timing and Sizes
via CWE-201
Show all 9

Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.

◆ AI Analysis — automated analysis, not human-reviewed

A vulnerability in the mischiefmarmot Create by Mediavine plugin allows for the insertion of sensitive information into sent data, potentially leading to data leakage or unauthorized access.

BSID: BS-2024-GLOBAL-204143-H • Model: /workspace/models/qwen2.5-coder-32b-instruct-bf16 • Confidence: MEDIUM

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →
Frequently Asked Questions
What is CVE-2024-43264?
A vulnerability in the mischiefmarmot Create by Mediavine plugin allows for the insertion of sensitive information into sent data, potentially leading to data leakage or unauthorized access.
What is the CVSS score for CVE-2024-43264?
CVE-2024-43264 has CVSS 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS: 0.4%.
Is CVE-2024-43264 actively exploited?
No confirmed active exploitation of CVE-2024-43264 as of 2026-09-25.
How do I remediate CVE-2024-43264?
Priority: MEDIUM.
What systems are affected by CVE-2024-43264?
CVE-2024-43264 affects Mediavine Create.
Vulnerability Details
CVE IDCVE-2024-43264
BSIDBS-2024-GLOBAL-204143-H BreachSpider Global ID
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Published2024-08-26
Last Modified2026-06-17
ICS Relevance0%
Weakness (CWE)
CWE-201
SourceNVD
Official Description

Insertion of Sensitive Information Into Sent Data vulnerability in mischiefmarmot Create by Mediavine mediavine-create.This issue affects Create by Mediavine: from n/a through <= 1.9.8.

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

An attacker could exploit this vulnerability by manipulating the data sent from the plugin, which may include sensitive user information, to be exposed to unauthorized parties.

Exploitation Likelihood: MEDIUM

Affected Products
VendorProductAffected Versions
Mediavine Create ≤ 1.9.8
Remediation

No official vendor advisory link on record. See the CVE record →

Threat Intelligence
● Threat Intelligence Validated: October 2026 | Threat Age: 780 Days
CISA known-exploitedNot in KEV catalog
Public ExploitNot confirmed
PoC CodeNot confirmed
AI Enrichment Record — provenance & audit hash
Model/workspace/models/qwen2.5-coder-32b-instruct-bf16
ConfidenceMEDIUM
Enriched At2026-05-24
SHA-512 Audit Hash21b94453a563db2dbcee2220bcb0be5412f5a435b9910abd24edb4cf52666750d5c67e6e136845c567d06d543418fab9d5019d1e32c08dffb3d1af09017aaeb4
Related CVEs affecting Mediavine
CVE-2024-1711 9.8 The Create by Mediavine plugin for WordPress is vulnerable to SQL Injection v... CVE-2023-44259 8.8 Cross-Site Request Forgery (CSRF) vulnerability in Mediavine Mediavine Contro... CVE-2024-43218 6.5 Improper Neutralization of Input During Web Page Generation ('Cross-site Scri... CVE-2024-5601 5.4 The Create by Mediavine plugin for WordPress is vulnerable to Stored Cross-Si... CVE-2024-37495 5.4 Improper Neutralization of Input During Web Page Generation ('Cross-site Scri...
View all Mediavine CVEs →

ICS/OT Vulnerability Intelligence for Your Environment

BreachSpider tracks 384,000+ CVEs and matches them to your ICS/OT assets by exact version, with AI analysis, NERC CIP mapping, and vendor PSIRT contacts.

Create a free account →