CVE-2024-6639

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-6639
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-6639.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-6639
Published
2024-08-12T13:49:22Z
Modified
2026-08-12T03:51:47Z
Severity
  • 6.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N CVSS Calculator
Summary
MDx <= 2.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via mdx_list_item Shortcode
Details

The MDx theme for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'mdx_list_item' shortcode in all versions up to, and including, 2.0.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Database specific 
{
    "cna_assigner": "Wordfence",
    "cwe_ids": [
        "CWE-79"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/6xxx/CVE-2024-6639.json"
}
References

Affected packages

Git / github.com/yrccondor/mdx

Affected ranges

Type
GIT
Repo
https://github.com/yrccondor/mdx
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
0906438824b8fab72715e7d5aec348aef0792721
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.0.3"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

1.*
1.8.7
1.8.8
1.8.9
V1.*
V1.4.1
V1.5.1
V1.7.10
V1.7.2
V1.7.3
V1.7.4
V1.7.5
V1.7.7
V1.7.8
V1.7.9
V1.8.0
V1.8.1
V1.8.10
V1.8.11
V1.8.12
V1.8.2
V1.8.3
V1.9.0
V1.9.1
V1.9.10
V1.9.2
V1.9.3
V1.9.5
V1.9.6
V1.9.7
V1.9.8
V1.9.9
V2.*
V2.0.0
V2.0.1
V2.0.2
V2.0.3

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-6639.json"