← Voltar para CVEs

CVE-2024-0559

MEDIUM

6.5

Descricao

The Enhanced Text Widget WordPress plugin before 1.6.6 does not validate and escape some of its Widget options before outputting them back in attributes, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

Detalhes CVE

Pontuacao CVSS v3.16.5

SeveridadeMEDIUM

Vetor CVSSCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Vetor de ataqueNETWORK

ComplexidadeLOW

Privilegios necessariosNONE

Interacao do usuarioNONE

Publicado3/11/2024

Ultima modificacao4/1/2025

Fontenvd

Avistamentos honeypot0

Produtos afetados

inisev:enhanced_text_widget

Fraquezas (CWE)

CWE-79

Referencias

https://research.cleantalk.org/cve-2024-0559/(contact@wpscan.com)

https://wpscan.com/vulnerability/b257daf2-9540-4a0f-a560-54b47d2b913f/(contact@wpscan.com)

https://research.cleantalk.org/cve-2024-0559/(af854a3a-2127-422b-91ae-364da2661108)

https://wpscan.com/vulnerability/b257daf2-9540-4a0f-a560-54b47d2b913f/(af854a3a-2127-422b-91ae-364da2661108)

Correlacoes IOC

Sem correlacoes registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.