CVE-2024-11154

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

The PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.5.15 via the 'actAjaxRevisionDiffs' function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to extract sensitive data including revisions of posts and pages.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published: Nov 20, 2024
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-111557.8A “use after free” code execution vulnerability exists in the Rockwell Automation Arena® that could allow a threat actor to craft a DOE fil CVE-2024-111567.8An “out of bounds write” code execution vulnerability exists in the Rockwell Automation Arena® that could allow a threat actor to write CVE-2024-111577.3A third-party vulnerability exists in the Rockwell Automation Arena® that could allow a threat actor to write beyond the boundaries of alloc CVE-2024-111586.7An “uninitialized variable” code execution vulnerability exists in the Rockwell Automation Arena® that could allow a threat actor to cra CVE-2024-111594.3Using remote content in OpenPGP encrypted messages can lead to the disclosure of plaintext. This vulnerability affects Thunderbird < 128.4.3 CVE-2024-11169.8A vulnerability was found in openBI up to 1.0.8. It has been classified as critical. Affected is the function index of the file /application CVE-2024-111655.7An information disclosure vulnerability exists in the backup configuration process where the SAS token is not masked in the configuration re CVE-2024-111667.1For TCAS II systems using transponders compliant with MOPS earlier than RTCA DO-181F, an attacker can impersonate a ground station and issue CVE-2024-111675.3An improper access control vulnerability in danny-avila/librechat versions prior to 0.7.6 allows authenticated users to delete other users' CVE-2024-111683.7The urllib.parse.urlsplit() and urlparse() functions improperly validated bracketed hosts (`[]`), allowing hosts that weren't IPv6 or IPvFut CVE-2024-111697.5An unhandled exception in danny-avila/librechat version 3c94ff2 can lead to a server crash. The issue occurs when the fs module throws an ex CVE-2024-11179.8A vulnerability was found in openBI up to 1.0.8. It has been declared as critical. Affected by this vulnerability is the function index of t