The CSSable Countdown WordPress plugin through 1.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
References
Link | Resource |
---|---|
https://wpscan.com/vulnerability/ad714196-2590-4dc9-b5b9-50808e9e0d26/ | Exploit Third Party Advisory |
Configurations
History
17 Jul 2024, 03:01
Type | Values Removed | Values Added |
---|---|---|
CPE | cpe:2.3:a:dmonnier:cssable_countdown:*:*:*:*:*:wordpress:*:* | |
References | () https://wpscan.com/vulnerability/ad714196-2590-4dc9-b5b9-50808e9e0d26/ - Exploit, Third Party Advisory | |
CWE | CWE-79 | |
CVSS |
v2 : v3 : |
v2 : unknown
v3 : 4.8 |
First Time |
Dmonnier cssable Countdown
Dmonnier |
08 Jul 2024, 14:19
Type | Values Removed | Values Added |
---|---|---|
Summary |
|
|
CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.1 |
21 Jun 2024, 06:15
Type | Values Removed | Values Added |
---|---|---|
New CVE |
Information
Published : 2024-06-21 06:15
Updated : 2024-07-17 03:01
NVD link : CVE-2024-4384
Mitre link : CVE-2024-4384
CVE.ORG link : CVE-2024-4384
JSON object : View
Products Affected
dmonnier
- cssable_countdown
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')