CVE-2024-11140

LowCVSS 3.5/10Last modified Jun 17, 2026

Description

The Real WP Shop Lite Ajax eCommerce Shopping Cart WordPress plugin through 2.0.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).

Metrics

CVSS 3.1 3.5/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
May 15, 2025
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-111416.1The Sailthru Triggermail WordPress plugin through 1.1 does not sanitise and escape some of its settings and is missing CSRF protection whichCVE-2024-111428.8Cross-Site Request Forgery (CSRF) vulnerability in Gosoft Software Proticaret E-Commerce allows Cross Site Request Forgery. This issue affeCVE-2024-111434.3The Kognetiks Chatbot for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2CVE-2024-111447.5The server lacks thread safety and can be crashed by anomalous data sent by an anonymous user from a remote network. The crash causes the FTCVE-2024-111459.8Valor Apps Easy Folder Listing Pro has a deserialization vulnerability that allows an unauthenticated, remote attacker to execute arbitrary CVE-2024-111466.3TrueFiling is a collaborative, web-based electronic filing system where attorneys, paralegals, court reporters and self-represented filers cCVE-2024-111477.6ECOVACS robot lawnmowers and vacuums use a deterministic root password generated based on model and serial number. An attacker with shell acCVE-2024-111487.5In OpenBSD 7.4 before errata 006 and OpenBSD 7.3 before errata 020, httpd(8) is vulnerable to a NULL dereference when handling a malformed fCVE-2024-111495.5In OpenBSD 7.4 before errata 014, vmm(4) did not restore GDTR limits properly on Intel (VMX) CPUs.CVE-2024-11159.8A vulnerability was found in openBI up to 1.0.8 and classified as critical. This issue affects the function dlfile of the file /application/CVE-2024-111509.8The WordPress User Extra Fields plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in thCVE-2024-111535.3The Content Control – The Ultimate Content Restriction Plugin! Restrict Content, Create Conditional Blocks & More plugin for WordPress is vu
CVE-2024-11140: Low severity, CVSS 3.5 | Vulnix