CVE-2024-5090 SiteOrigin Widgets Bundle <= 1.61.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via SiteOrigin Blog Widget

🗓️ 11 Jun 2024 02:01:54Reported by GoogleType

osv

osv🔗 osv.dev👁 8 Views

Vulnerability in SiteOrigin Widgets Bundle allows stored cross-site scripting attacks via user input.

Reporter	Title	Published	Views	Family All 11
CNNVD	WordPress plugin SiteOrigin Widgets Bundle security vulnerability	11 Jun 202400:00	–	cnnvd
CVE	CVE-2024-5090	11 Jun 202402:01	–	cve
Cvelist	CVE-2024-5090 SiteOrigin Widgets Bundle <= 1.61.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via SiteOrigin Blog Widget	11 Jun 202402:01	–	cvelist
EUVD	EUVD-2024-46347	3 Oct 202520:07	–	euvd
NVD	CVE-2024-5090	11 Jun 202403:15	–	nvd
Patchstack	WordPress SiteOrigin Widgets Bundle plugin <= 1.61.1 - Authenticated Stored Cross-Site Scripting vulnerability	10 Jun 202413:12	–	patchstack
Patchstack	WordPress SiteOrigin Widgets Bundle Plugin <= 1.61.1 is vulnerable to Cross Site Scripting (XSS)	10 Jun 202400:00	–	patchstack
RedhatCVE	CVE-2024-5090	23 May 202508:47	–	redhatcve
Vulnrichment	CVE-2024-5090 SiteOrigin Widgets Bundle <= 1.61.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via SiteOrigin Blog Widget	11 Jun 202402:01	–	vulnrichment
Wordfence Blog	Wordfence Intelligence Weekly WordPress Vulnerability Report (June 10, 2024 to June 16, 2024)	20 Jun 202413:40	–	wordfence

Source	Link
plugins	www.plugins.trac.wordpress.org/changeset/3098819/so-widgets-bundle
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/2878de45-0123-4e07-bfec-015b36b11d01
github	www.github.com/CVEProject/cvelistV5/tree/main/cves/2024/5xxx/CVE-2024-5090.json
nvd	www.nvd.nist.gov/vuln/detail/CVE-2024-5090

08 Jul 2026 07:03Current

6.1Medium risk

Vulners AI Score6.1

CVSS 3.16.4

EPSS0.00298

cve-2024-5090 wordpress plugin stored cross-site scripting user input insufficient sanitization authenticated attackers