CVE-2024-9578

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2024-9578

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-9578.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2024-9578

Published

2024-11-13T02:02:29.677Z

Modified

2026-08-12T03:51:42.242661570Z

Severity

5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVSS Calculator

Summary

Hide Links <= 1.4.2 - Unauthenticated Shortcode Execution

Details

The Hide Links plugin for WordPress is vulnerable to unauthorized shortcode execution due to doshortcode being hooked through the commenttext filter in all versions up to and including 1.4.2. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes available on the target site.

Database specific

{
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "last_affected": "1.4.2"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ],
    "cna_assigner": "Wordfence",
    "cwe_ids": [
        "CWE-862"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/9xxx/CVE-2024-9578.json"
}

References

Affected packages

Git / github.com/avovkdesign/hidelinks

Affected ranges

Type

GIT

Repo

https://github.com/avovkdesign/hidelinks

Events

Introduced

Last affected

57d673f27f542f435bc81cccbdddd125bb9d3479

Database specific

Show details

{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "1.4.2"
        }
    ],
    "source": "CPE_RANGE",
    "cpe": "cpe:2.3:a:avovkdesign:hide_links:*:*:*:*:*:wordpress:*:*"
}

Affected versions

1.*

1.1

1.2

1.3

1.4

1.4.1

1.4.2

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-9578.json"