CVE-2024-9020

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-9020
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-9020.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-9020
Published
2025-01-18T06:00:05.173Z
Modified
2026-07-15T01:49:00.373039500Z
Severity
  • 5.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
Summary
List category posts < 0.90.3 - Author+ Stored XSS
Details

The List category posts WordPress plugin before 0.90.3 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.

Database specific 
{
    "cna_assigner": "WPScan",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "fixed": "0.90.3"
                }
            ],
            "source": "AFFECTED_FIELD"
        },
        {
            "extracted_events": [
                {
                    "fixed": "0.90.3"
                }
            ],
            "source": "DESCRIPTION"
        }
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/9xxx/CVE-2024-9020.json"
}
References

Affected packages

Git / github.com/picandocodigo/list-category-posts

Affected ranges

Type
GIT
Repo
https://github.com/picandocodigo/list-category-posts
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
57629ab2fdf0bd12af8c3ae2e1d8c3101f7936de
Database specific
Show details 
{
    "cpe": "cpe:2.3:a:fernandobriano:list_category_posts:*:*:*:*:*:wordpress:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "0.90.3"
        }
    ],
    "source": "CPE_RANGE"
}

Affected versions

0.*
0.65
0.66
0.67
0.68
0.72
0.75
0.85.1
v0.*
v0.36-pagination-alpha.1
v0.38-alpha
v0.46.4
v0.77
v0.78
v0.79
v0.80.1
v0.80.2
v0.81
v0.82
v0.83
v0.83.1
v0.84
v0.84.1
v0.84.2
v0.85
v0.86
v0.86.1
v0.87
v0.88
v0.88.1
v0.89
v0.89.1
v0.89.2
v0.89.3
v0.89.4
v0.89.5
v0.89.6
v0.89.7
v0.89.8
v0.89.9
v0.90.0
v0.90.1
v0.90.2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-9020.json"