Lucene search

K
patchstackThanayut MaktheppongtPATCHSTACK:6E95402619516CE705490B404F888E3F
HistoryOct 24, 2024 - 12:00 a.m.

WordPress EmbedPress Plugin <= 4.0.14 is vulnerable to Cross Site Scripting (XSS)

2024-10-2400:00:00
Thanayut Maktheppongt
patchstack.com
wordpress
embedpress
plugin
cross site scripting
xss
vulnerable
fixed
cve-2024-50461
owasp top 10
injection

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

AI Score

6.5

Confidence

High

EPSS

0

Percentile

9.9%

Software

EmbedPress

Type

Plugin

Vulnerable versions

<= 4.0.14

Fixed in

4.1.0

OWASP Top 10

A3: Injection

Classification

Cross Site Scripting (XSS)

CVE

CVE-2024-50461

Patch priority

Low

CVSS severity

Low (6.5)

Developer

Claim ownership

PSID

bd680c64cbcd

Credits

Thanayut Maktheppongt Thanayut Maktheppongt

Required privilege

Contributor

Published

24 October, 2024

Remove and replace plugin Expand full details Have additional information or questions about this entry? Let us know.

Solution

This security issue has a low severity impact and is unlikely to be exploited.

Affected configurations

Vulners
Node
wpdeveloperembedpressRange4.0.14wordpress
VendorProductVersionCPE
wpdeveloperembedpress*cpe:2.3:a:wpdeveloper:embedpress:*:*:*:*:*:wordpress:*:*

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

AI Score

6.5

Confidence

High

EPSS

0

Percentile

9.9%

Related for PATCHSTACK:6E95402619516CE705490B404F888E3F