CVE-2024-3886

🗓️ 31 Aug 2024 05:15:13Reported by [email protected]Type

The tagDiv Composer plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘envato_code[]’ parameter in all versions up to, and including, 5.0 due to insufficient input sanitization and output escaping within the on_ajax_check_envato_code function. This allows unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action

Reporter	Title	Published	Views	Family All 12
Circl	CVE-2024-3886	31 Aug 202407:32	–	circl
CNNVD	WordPress plugin tagDiv Composer 跨站脚本漏洞	31 Aug 202400:00	–	cnnvd
CVE	CVE-2024-3886	31 Aug 202404:29	–	cve
Cvelist	CVE-2024-3886 tagDiv Composer <= 5.0 - Reflected Cross-Site Scripting via envato_code[]	31 Aug 202404:29	–	cvelist
EUVD	EUVD-2024-32454	3 Oct 202520:07	–	euvd
OSV	CVE-2024-3886	31 Aug 202405:15	–	osv
Patchstack	WordPress tagDiv Composer plugin <= 5.0 - Reflected Cross-Site Scripting via envato_code[] vulnerability	2 Sep 202403:44	–	patchstack
Patchstack	WordPress tagDiv Composer Plugin <= 5.0 is vulnerable to Cross Site Scripting (XSS)	2 Sep 202400:00	–	patchstack
Positive Technologies	PT-2024-28241 · Tagdiv · Tagdiv Composer	30 Aug 202400:00	–	ptsecurity
RedhatCVE	CVE-2024-3886	23 May 202510:31	–	redhatcve