CVE-2024-6864
See a problem?- Source
- https://nvd.nist.gov/vuln/detail/CVE-2024-6864
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-6864.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2024-6864
- Published
- 2024-08-20T05:15:12Z
- Modified
- 2024-09-05T01:35:53.049143Z
- Severity
-
- 5.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
- Summary
- [none]
- Details
-
The WP Last Modified Info plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘template’ attribute of the lmt-post-modified-info shortcode in all versions up to, and including, 1.9.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- References
-
- https://plugins.trac.wordpress.org/browser/wp-last-modified-info/trunk/inc/Core/Frontend/PostView.php#L205
- https://plugins.trac.wordpress.org/changeset/3137253/
- https://plugins.trac.wordpress.org/changeset/3137253/#file23
- https://wordpress.org/plugins/wp-last-modified-info/#developers
- https://www.wordfence.com/threat-intel/vulnerabilities/id/87368d85-04d4-42e6-9ba6-2a1fc3b945a8?source=cve