exploitDog

CVE-2024-2309

Опубликовано: 17 апр. 2024

Источник: nvd

CVSS3: 4.8

EPSS Низкий

Описание

The WP STAGING WordPress Backup Plugin WordPress plugin before 3.4.0, wp-staging-pro WordPress plugin before 5.4.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

Ссылки

https://wpscan.com/vulnerability/a4152818-1e07-46a7-aec4-70f1a1b579a6/
Exploit
Third Party Advisory
https://wpscan.com/vulnerability/a4152818-1e07-46a7-aec4-70f1a1b579a6/
Exploit
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:wp-staging:wp_staging:*:*:*:*:*:wordpress:*:*

Версия до 3.4.0 (исключая)

EPSS

Процентиль: 40%

0.00186

Низкий

4.8 Medium

CVSS3

Дефекты

CWE-79

Связанные уязвимости

GHSA-67wm-85xj-pgvv

CVSS3: 4.8

github

почти 2 года назад

The WP STAGING WordPress Backup Plugin WordPress plugin before 3.4.0, wp-staging-pro WordPress plugin before 5.4.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

EPSS

Процентиль: 40%

0.00186

Низкий

4.8 Medium

CVSS3

Дефекты

CWE-79