Lucene search

PatchstackCVELIST:CVE-2024-39660

HistoryAug 01, 2024 - 9:43 p.m.

CVE-2024-39660 WordPress Photo Engine (Media Organizer & Lightroom) plugin <= 6.3.1 - Cross Site Scripting (XSS) vulnerability

2024-08-0121:43:02

CWE-79

Patchstack

www.cve.org

cve-2024-39660

wordpress

cross site scripting

xss

vulnerability

photo engine

jordy meow.

CVSS3

5.9

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L

EPSS

Percentile

9.4%

JSON

Improper Neutralization of Input During Web Page Generation (XSS or ‘Cross-site Scripting’) vulnerability in Jordy Meow Photo Engine allows Stored XSS.This issue affects Photo Engine: from n/a through 6.3.1.

CNA Affected

[
  {
    "collectionURL": "https://wordpress.org/plugins",
    "defaultStatus": "unaffected",
    "packageName": "wplr-sync",
    "product": "Photo Engine",
    "vendor": "Jordy Meow",
    "versions": [
      {
        "changes": [
          {
            "at": "6.3.2",
            "status": "unaffected"
          }
        ],
        "lessThanOrEqual": "6.3.1",
        "status": "affected",
        "version": "n/a",
        "versionType": "custom"
      }
    ]
  }
]

References

patchstack.com/database/vulnerability/wplr-sync/wordpress-photo-engine-media-organizer-lightroom-plugin-6-3-1-cross-site-scripting-xss-vulnerability?_s_id=cve