CVE-2024-4384

The CSSable Countdown WordPress plugin through 1.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

WordPress CSSable Countdown Plugin <= 1.5 is vulnerable to Cross Site Scripting (XSS)

Software CSSable Countdown Type Plugin Vulnerable versions = 1.5 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-4384 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 5ddf21dac862 Credits Bob Matyas Required...