CVE-2024-11690

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

The Financial Stocks & Crypto Market Data Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'e' parameter in all versions up to, and including, 1.10.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Jan 7, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-116918.8Certain WebGL operations on Apple silicon M series devices could have lead to an out-of-bounds write and memory corruption due to a flaw in CVE-2024-116924.3An attacker could cause a select dropdown to be shown over another tab; this could have led to user confusion and possible spoofing attacks.CVE-2024-116939.8The executable file warning was not presented when downloading .library-ms files. *Note: This issue only affected Windows operating system CVE-2024-116946.1Enhanced Tracking Protection's Strict mode may have inadvertently allowed a CSP `frame-src` bypass and DOM-based XSS through the Google Safe CVE-2024-116955.4A crafted URL containing Arabic script and whitespace characters could have hidden the true origin of the page, resulting in a potential spo CVE-2024-116965.4The application failed to account for exceptions thrown by the `loadManifestFromFile` method during add-on signature verification. This flaw CVE-2024-116978.8When handling keypress events, an attacker may have been able to trick a user into bypassing the "Open Executable File?" confirmation dialog CVE-2024-116989.8A flaw in handling fullscreen transitions may have inadvertently caused the application to become stuck in fullscreen mode when a modal dial CVE-2024-116998.8Memory safety bugs present in Firefox 132, Firefox ESR 128.4, and Thunderbird 128.4. Some of these bugs showed evidence of memory corruption CVE-2024-11708.2The Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) plugin for WordPress CVE-2024-117008.1Malicious websites may have been able to perform user intent confirmation through tapjacking. This could have led to users unknowingly appro CVE-2024-117014.3The incorrect domain may have been displayed in the address bar during an interrupted navigation attempt. This could have led to user confus