CVE-2024-0757

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

The Insert or Embed Articulate Content into WordPress plugin through 4.3000000023 is not properly filtering which file extensions are allowed to be imported on the server, allowing the uploading of malicious code within zip files

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-434

Affected software

Vendor	Product	Versions
Unknown	Insert or Embed Articulate Content into WordPress	<= 4.3000000023

References

https://wpscan.com/vulnerability/eccd017c-e442-46b6-b5e6-aec7bbd5f836/Exploit, Third Party Advisory
https://wpscan.com/vulnerability/eccd017c-e442-46b6-b5e6-aec7bbd5f836/Exploit, Third Party Advisory

Timeline

Published: Jun 4, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-07586.1MolecularFaces before 0.3.0 is vulnerable to cross site scripting. A remote attacker can execute arbitrary JavaScript in the context of a vi CVE-2024-07597.5Should an instance of AnythingLLM be hosted on an internal network and the attacked be explicitly granted a permission level of manager or a CVE-2024-07607.5A malicious client can send many DNS messages over TCP, potentially causing the server to become unstable while the attack is in progress. T CVE-2024-07617.5The File Manager plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.2.1 due to ins CVE-2024-07627.8Potential buffer overflow in unsafe UEFI variable handling in Phoenix SecureCore™ for select Intel platforms This issue affects: Phoe CVE-2024-07638.1Any user can delete an arbitrary folder (recursively) on a remote server due to bad input sanitization leading to path traversal. The attack CVE-2024-07656.5As a default user on a multi-user instance of AnythingLLM, you could execute a call to the `/export-data` endpoint of the system and then un CVE-2024-07664.3The Envo's Elementor Templates & Widgets for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a mi CVE-2024-07674.3The Envo's Elementor Templates & Widgets for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to,CVE-2024-07684.3The Envo's Elementor Templates & Widgets for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to CVE-2024-07699.8** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in D-Link DIR-859 1.06B01. It has been rated as critical. Affected by this issue i CVE-2024-07707.1A vulnerability, which was classified as critical, was found in European Chemicals Agency IUCLID 7.10.3 on Windows. Affected is an unknown f