CVE-2024-11202

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

Multiple plugins for WordPress are vulnerable to Reflected Cross-Site Scripting via the cminds_free_guide shortcode in various versions due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Nov 26, 2024
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-112035.4The EmbedPress – Embed PDF, 3D Flipbook, Social Feeds, Google Docs, Vimeo, Wistia, YouTube Videos, Audios, Google Maps in Gutenberg Block & CVE-2024-112046.1The ForumWP – Forum & Discussion Board plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘url’ parameter in all v CVE-2024-112056.5The WPForms plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wpforms_is_adm CVE-2024-112067.5Unauthorized access vulnerability in the mobile application (com.transsion.phoenix) can lead to the leakage of user information.CVE-2024-112075.4A vulnerability has been found in Apereo CAS 6.6 and classified as problematic. Affected by this vulnerability is an unknown functionality o CVE-2024-112088.1A vulnerability was found in Apereo CAS 6.6 and classified as problematic. Affected by this issue is some unknown functionality of the file CVE-2024-112099.8A vulnerability was found in Apereo CAS 6.6. It has been classified as critical. This affects an unknown part of the file /login?service of CVE-2024-11215.3The Advanced Forms for ACF plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the export CVE-2024-112105.4A vulnerability was found in EyouCMS 1.51. It has been rated as critical. This issue affects the function editFile of the file application/a CVE-2024-112117.2A vulnerability classified as critical has been found in EyouCMS up to 1.6.7. Affected is an unknown function of the component Website Logo CVE-2024-112128.8A vulnerability, which was classified as critical, has been found in SourceCodester Best Employee Management System 1.0. Affected by this is CVE-2024-112137.2A vulnerability, which was classified as critical, was found in SourceCodester Best Employee Management System 1.0. This affects an unknown