CVE-2024-5578

The Table of Contents Plus WordPress plugin through 2408 does not sanitise and escape some of its settings, which could allow high privilege users such as editors to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
References
Configurations

Configuration 1 (hide)

cpe:2.3:a:dublue:table_of_contents_plus:*:*:*:*:*:wordpress:*:*

History

06 Nov 2024, 15:44

Type Values Removed Values Added
References () https://wpscan.com/vulnerability/641e4fc3-4214-4c2e-8245-15e9dcdd37b4/ - () https://wpscan.com/vulnerability/641e4fc3-4214-4c2e-8245-15e9dcdd37b4/ - Exploit, Third Party Advisory
CPE cpe:2.3:a:dublue:table_of_contents_plus:*:*:*:*:*:wordpress:*:*
Summary
  • (es) El complemento Table of Contents Plus para WordPress hasta la versión 2408 no desinfecta ni escapa a algunas de sus configuraciones, lo que podría permitir que usuarios con privilegios elevados, como editores, realicen ataques de Cross Site Scripting incluso cuando unfiltered_html no está permitido.
First Time Dublue table Of Contents Plus
Dublue
CWE CWE-79

05 Nov 2024, 17:35

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown
v2 : unknown
v3 : 4.8

05 Nov 2024, 06:15

Type Values Removed Values Added
New CVE

Information

Published : 2024-11-05 06:15

Updated : 2024-11-06 15:44


NVD link : CVE-2024-5578

Mitre link : CVE-2024-5578

CVE.ORG link : CVE-2024-5578


JSON object : View

Products Affected

dublue

  • table_of_contents_plus
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')