CVE-2024-12749

HighCVSS 7.1/10Last modified Jun 17, 2026

Description

The Competition Form WordPress plugin through 2.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Unknown	Competition Form	<= 2.0

References

https://wpscan.com/vulnerability/478316b9-9f47-4aa6-92c6-03879f16a3e5/Exploit, Third Party Advisory
https://wpscan.com/vulnerability/478316b9-9f47-4aa6-92c6-03879f16a3e5/Exploit, Third Party Advisory

Timeline

Published: Jan 29, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-12759.1Use of Default Cryptographic Key vulnerability in Baxter Welch Allyn Connex Spot Monitor may allow Configuration/Environment Manipulation.Th CVE-2024-127504.3The Competition Form WordPress plugin through 2.0 does not have CSRF check in place when updating its settings, which could allow attackers CVE-2024-127517.8Foxit PDF Reader AcroForm Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbi CVE-2024-127527.8Foxit PDF Reader AcroForm Memory Corruption Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbit CVE-2024-127537.3Foxit PDF Reader Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges o CVE-2024-127545.5AnyDesk Link Following Information Disclosure Vulnerability. This vulnerability allows local attackers to disclose sensitive information on CVE-2024-127555.4A Cross-Site Scripting (XSS) vulnerability in Avaya Spaces may have allowed unauthorized code execution and potential disclose of sensitive CVE-2024-127566.1An HTML Injection vulnerability in Avaya Spaces may have allowed disclosure of sensitive information or modification of the page content see CVE-2024-127578.6Nedap Librix Ecoreader is missing authentication for critical functions that could allow an unauthenticated attacker to potentially execu CVE-2024-12766.4The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to St CVE-2024-127617.5A Denial of Service (DoS) vulnerability exists in the brycedrennan/imaginairy repository, version 15.0.0. The vulnerability is present in th CVE-2024-127667.5parisneo/lollms-webui version V13 (feather) suffers from a Server-Side Request Forgery (SSRF) vulnerability in the `POST /api/proxy` REST AP