The Table of Contents Plus WordPress plugin through 2408 does not sanitise and escape some of its settings, which could allow high privilege users such as editors to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
References
Link | Resource |
---|---|
https://wpscan.com/vulnerability/641e4fc3-4214-4c2e-8245-15e9dcdd37b4/ | Exploit Third Party Advisory |
Configurations
History
06 Nov 2024, 15:44
Type | Values Removed | Values Added |
---|---|---|
References | () https://wpscan.com/vulnerability/641e4fc3-4214-4c2e-8245-15e9dcdd37b4/ - Exploit, Third Party Advisory | |
CPE | cpe:2.3:a:dublue:table_of_contents_plus:*:*:*:*:*:wordpress:*:* | |
Summary |
|
|
First Time |
Dublue table Of Contents Plus
Dublue |
|
CWE | CWE-79 |
05 Nov 2024, 17:35
Type | Values Removed | Values Added |
---|---|---|
CVSS |
v2 : v3 : |
v2 : unknown
v3 : 4.8 |
05 Nov 2024, 06:15
Type | Values Removed | Values Added |
---|---|---|
New CVE |
Information
Published : 2024-11-05 06:15
Updated : 2024-11-06 15:44
NVD link : CVE-2024-5578
Mitre link : CVE-2024-5578
CVE.ORG link : CVE-2024-5578
JSON object : View
Products Affected
dublue
- table_of_contents_plus
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')