CVE-2024-0756

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

The Insert or Embed Articulate Content into WordPress plugin through 4.3000000023 lacks validation of URLs when adding iframes, allowing attackers to inject an iFrame in the page and thus load arbitrary content from any page.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Jun 4, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-07575.4The Insert or Embed Articulate Content into WordPress plugin through 4.3000000023 is not properly filtering which file extensions are allowe CVE-2024-07586.1MolecularFaces before 0.3.0 is vulnerable to cross site scripting. A remote attacker can execute arbitrary JavaScript in the context of a vi CVE-2024-07597.5Should an instance of AnythingLLM be hosted on an internal network and the attacked be explicitly granted a permission level of manager or a CVE-2024-07607.5A malicious client can send many DNS messages over TCP, potentially causing the server to become unstable while the attack is in progress. T CVE-2024-07617.5The File Manager plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.2.1 due to ins CVE-2024-07627.8Potential buffer overflow in unsafe UEFI variable handling in Phoenix SecureCore™ for select Intel platforms This issue affects: Phoe CVE-2024-07638.1Any user can delete an arbitrary folder (recursively) on a remote server due to bad input sanitization leading to path traversal. The attack CVE-2024-07656.5As a default user on a multi-user instance of AnythingLLM, you could execute a call to the `/export-data` endpoint of the system and then un CVE-2024-07664.3The Envo's Elementor Templates & Widgets for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a mi CVE-2024-07674.3The Envo's Elementor Templates & Widgets for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to,CVE-2024-07684.3The Envo's Elementor Templates & Widgets for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to CVE-2024-07699.8** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in D-Link DIR-859 1.06B01. It has been rated as critical. Affected by this issue i