CVE-2024-4757

🗓️ 25 Jun 2024 06:00:02Reported by WPScanType

cve🔗 web.nvd.nist.gov👁 50 Views🌐 WEB

Logo Manager For Enamad WordPress plugin CSRF and XSS vulnerabilitie

Reporter	Title	Published	Views	Family All 11
CNNVD	WordPress Plugin Logo Manager For Enamad Security Vulnerability	25 Jun 202400:00	–	cnnvd
Cvelist	CVE-2024-4757 Logo Manager For Enamad <= 0.7.0 - Stored XSS via CSRF	25 Jun 202406:00	–	cvelist
NVD	CVE-2024-4757	25 Jun 202406:15	–	nvd
Patchstack	WordPress Logo Manager For Enamad Plugin <= 0.7.0 is vulnerable to Cross Site Request Forgery (CSRF)	25 Jun 202400:00	–	patchstack
Patchstack	WordPress Logo Manager For Enamad plugin <= 0.7.0 - CSRF to Stored XSS vulnerability	25 Jun 202406:55	–	patchstack
Positive Technologies	PT-2024-32661 · WordPress · The Logo Manager For Enamad	25 Jun 202400:00	–	ptsecurity
RedhatCVE	CVE-2024-4757	23 May 202509:31	–	redhatcve
Vulnrichment	CVE-2024-4757 Logo Manager For Enamad <= 0.7.0 - Stored XSS via CSRF	25 Jun 202406:00	–	vulnrichment
Wordfence Blog	Wordfence Intelligence Weekly WordPress Vulnerability Report (June 3, 2024 to June 9, 2024)	13 Jun 202415:35	–	wordfence
wpexploit	Logo Manager For Enamad <= 0.7.0 - Stored XSS via CSRF	4 Jun 202400:00	–	wpexploit

NVD

Vulners

Vulnrichment

Node

wp-master logo_manager_for_enamadRange≤0.7wordpress

[
  {
    "vendor": "Unknown",
    "product": "Logo Manager For Enamad",
    "versions": [
      {
        "status": "affected",
        "versionType": "semver",
        "version": "0",
        "lessThanOrEqual": "0.7.0"
      }
    ],
    "defaultStatus": "affected"
  }
]

Source	Link
wpscan	www.wpscan.com/vulnerability/b54b55e0-b184-4c90-ba94-feda0997bf2a/

Parameter	Position	Path	Description	CWE
enamad-enable	request body	wp-admin/options-general.php?page=enamadlogo-options	Stored XSS via CSRF in the Enamad logo options form; an attacker can cause a logged-in admin to submit crafted payloads that execute-script content.	CWE-352, CWE-79
enamad-width	request body	wp-admin/options-general.php?page=enamadlogo-options	Stored XSS via CSRF in the Enamad logo options form; an attacker can cause a logged-in admin to submit crafted payloads that execute-script content.	CWE-352, CWE-79
enamad-position	request body	wp-admin/options-general.php?page=enamadlogo-options	Stored XSS via CSRF in the Enamad logo options form; an attacker can cause a logged-in admin to submit crafted payloads that execute-script content.	CWE-352, CWE-79
enamad-view-method	request body	wp-admin/options-general.php?page=enamadlogo-options	Stored XSS via CSRF in the Enamad logo options form; an attacker can cause a logged-in admin to submit crafted payloads that execute-script content.	CWE-352, CWE-79
enamad-code	request body	wp-admin/options-general.php?page=enamadlogo-options	Stored XSS via CSRF in the Enamad logo options form; an attacker can cause a logged-in admin to submit crafted payloads that execute-script content.	CWE-352, CWE-79
enamad-shamed-code	request body	wp-admin/options-general.php?page=enamadlogo-options	Stored XSS via CSRF in the Enamad logo options form; an attacker can cause a logged-in admin to submit crafted payloads that execute-script content.	CWE-352, CWE-79
enamad-custom-code	request body	wp-admin/options-general.php?page=enamadlogo-options	Stored XSS via CSRF in the Enamad logo options form; an attacker can cause a logged-in admin to submit crafted payloads that execute-script content.	CWE-352, CWE-79
enamad-submit	request body	wp-admin/options-general.php?page=enamadlogo-options	Stored XSS via CSRF in the Enamad logo options form; an attacker can cause a logged-in admin to submit crafted payloads that execute-script content.	CWE-352, CWE-79

19 May 2025 21:04Current

7.7High risk

Vulners AI Score7.7

CVSS 3.18.1

EPSS0.00508

SSVC