Lucene search

PatchstackCVELIST:CVE-2024-37561

HistoryJul 20, 2024 - 9:18 a.m.

CVE-2024-37561 WordPress Plugin Notes Plus plugin <= 1.2.6 - Cross Site Scripting (XSS) vulnerability

2024-07-2009:18:10

CWE-79

Patchstack

www.cve.org

cve-2024-37561

cross site scripting

wordpress plugin

CVSS3

5.9

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L

EPSS

Percentile

9.3%

JSON

Improper Neutralization of Input During Web Page Generation (XSS or ‘Cross-site Scripting’) vulnerability in Jamie Bergen Plugin Notes Plus allows Stored XSS.This issue affects Plugin Notes Plus: from n/a through 1.2.6.

CNA Affected

[
  {
    "collectionURL": "https://wordpress.org/plugins",
    "defaultStatus": "unaffected",
    "packageName": "plugin-notes-plus",
    "product": "Plugin Notes Plus",
    "vendor": "Jamie Bergen",
    "versions": [
      {
        "changes": [
          {
            "at": "1.2.7",
            "status": "unaffected"
          }
        ],
        "lessThanOrEqual": "1.2.6",
        "status": "affected",
        "version": "n/a",
        "versionType": "custom"
      }
    ]
  }
]

References

patchstack.com/database/vulnerability/plugin-notes-plus/wordpress-plugin-notes-plus-plugin-1-2-6-cross-site-scripting-xss-vulnerability?_s_id=cve