Lucene search
Aditya VyawahareWPVDB-ID:6A8A1DEB-6836-40F1-856B-7B3E4BA867D6HistoryJun 11, 2024 - 12:00 a.m.
EazyDocs < 2.5.0 - Admin+ Stored XSS
2024-06-1100:00:00
Aditya Vyawahare
wpscan.com
6
eazydocs
admin privilege
stored xss
unsanitised settings
multisite setup
cross-site scripting
update
june 25 2024
Description The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
PoC
The PoC will be displayed on June 25, 2024, to give users the time to update.
Related
cvelist
cvelist
CVE-2024-3999 EazyDocs < 2.5.0 - Admin+ Stored XSS
2024-07-02 06:00:02
vulnrichment
vulnrichment
CVE-2024-3999 EazyDocs < 2.5.0 - Admin+ Stored XSS
2024-07-02 06:00:02
wpexploit
wpexploit
EazyDocs < 2.5.0 - Admin+ Stored XSS
2024-06-11 00:00:00
nvd
nvd
CVE-2024-3999
2024-07-02 06:15:04
cve
cve
CVE-2024-3999
2024-07-02 06:15:04
wordfence
wordfence
AI Score
5.9
Confidence
High
EPSS
0
Percentile
14.2%
Related for WPVDB-ID:6A8A1DEB-6836-40F1-856B-7B3E4BA867D6