CVE-2024-5645

The CVE-2024-5645 issue affects the Envo Extra WordPress plugin and is a Stored XSS in the Button widget via the button_css_id parameter in all versions up to 1.8.23. An authenticated attacker with Contributor+ rights can inject scripts that execute when pages are viewed. Public advisories indica...

WordPress Envo Extra Plugin <= 1.8.23 is vulnerable to Cross Site Scripting (XSS)

Software Envo Extra Type Plugin Vulnerable versions = 1.8.23 Fixed in 1.8.25 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-5645 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID fd6ee8e2d137 Credits wesley wcraft Required...