CVE-2024-4477 WP Logs Book <= 1.0.1 - Unauthenticated Stored XSS

2024-06-2106:00:04

WPScan

www.cve.org

cve-2024-4477

wordpress

plugin

unauthenticated stored xss

admin dashboard

cross-site scripting

0.0004 Low

EPSS

Percentile

14.1%

JSON

The WP Logs Book WordPress plugin through 1.0.1 does not sanitise and escape some of its log data before outputting them back in an admin dashboard, leading to an Unauthenticated Stored Cross-Site Scripting

CNA Affected

[
  {
    "vendor": "Unknown",
    "product": "WP Logs Book",
    "versions": [
      {
        "status": "affected",
        "versionType": "semver",
        "version": "0",
        "lessThanOrEqual": "1.0.1"
      }
    ],
    "defaultStatus": "affected"
  }
]

References

wpscan.com/vulnerability/ab551552-944c-4e2a-9355-7011cbe553b0/

0.0004 Low

EPSS

Percentile

14.1%

JSON

Related for CVELIST:CVE-2024-4477