WordPress Elespare plugin <= 3.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Horizontal Nav Menu Widget vulnerability

🗓️ 13 Jun 2024 09:33:35Reported by stealthcopterType

Authenticated contributor stored cross site scripting in Elespare plugin via the Horizontal Nav Menu Widget.

Reporter	Title	Published	Views	Family All 11
CNNVD	WordPress plugin Elespare security vulnerability	13 Jun 202400:00	–	cnnvd
CVE	CVE-2024-4615	13 Jun 202407:31	–	cve
Cvelist	CVE-2024-4615 Elespare – Blog, Magazine and Newspaper Addons for Elementor with Templates, Widgets, Kits, and Header/Footer Builder. One Click Import: No Coding Required! <= 3.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Horizontal Nav Menu Widget	13 Jun 202407:31	–	cvelist
EUVD	EUVD-2024-44223	3 Oct 202520:07	–	euvd
NVD	CVE-2024-4615	13 Jun 202408:16	–	nvd
OSV	CVE-2024-4615	13 Jun 202408:16	–	osv
Patchstack	WordPress Elespare Plugin <= 3.1.2 is vulnerable to Cross Site Scripting (XSS)	13 Jun 202400:00	–	patchstack
RedhatCVE	CVE-2024-4615	23 May 202509:12	–	redhatcve
Vulnrichment	CVE-2024-4615 Elespare – Blog, Magazine and Newspaper Addons for Elementor with Templates, Widgets, Kits, and Header/Footer Builder. One Click Import: No Coding Required! <= 3.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Horizontal Nav Menu Widget	13 Jun 202407:31	–	vulnrichment
Wordfence Blog	Wordfence Intelligence Weekly WordPress Vulnerability Report (June 10, 2024 to June 16, 2024)	20 Jun 202413:40	–	wordfence

Vulners

Node

Source	Link
wordfence	www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/elespare/elespare-blog-magazine-and-newspaper-addons-for-elementor-with-templates-widgets-kits-and-headerfooter-builder-one-click-import-no-coding-required-312-authenticated-contribu

13 Jun 2024 09:33Current

5.8Medium risk

Vulners AI Score5.8

CVSS 3.15.4 - 6.4

EPSS0.01221

SSVC