CVE-2024-12800

MediumCVSS 4.8/10Last modified Jun 17, 2026

Description

The IP Based Login WordPress plugin before 2.4.1 does not sanitise values when importing, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Unknown	IP Based Login	< 2.4.1

References

https://wpscan.com/vulnerability/8f1ceca5-3b7b-4cf0-bccd-03e204e5bfad/Exploit, Third Party Advisory
https://wpscan.com/vulnerability/8f1ceca5-3b7b-4cf0-bccd-03e204e5bfad/Exploit, Third Party Advisory

Timeline

Published: May 15, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-128012.4Server-Side Request Forgery (SSRF) in SaxEventRecorder by QOS.CH logback version 0.1 to 1.3.14 and 1.4.0 to 1.5.12 on the Java platform, al CVE-2024-128029.1SSL-VPN MFA Bypass in SonicWALL SSL-VPN can arise in specific cases due to the separate handling of UPN (User Principal Name) and SAM (Secur CVE-2024-128037.2A post-authentication stack-based buffer overflow vulnerability in SonicOS management allows a remote attacker to crash a firewall and poten CVE-2024-128057.2A post-authentication format string vulnerability in SonicOS management allows a remote attacker to crash a firewall and potentially leads t CVE-2024-128064.9A post-authentication absolute path traversal vulnerability in SonicOS management allows a remote attacker to read an arbitrary file.CVE-2024-128074.8The Social Share Buttons for WordPress plugin through 2.7 does not sanitise and escape some of its settings, which could allow high privileg CVE-2024-128084.8The WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting WordPress plugin before 1.13.4 does not san CVE-2024-128096.4The Wishlist plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wishlist_button' shortcode in all versions CVE-2024-128108.1The JobCareer | Job Board Responsive WordPress Theme theme for WordPress is vulnerable to unauthorized access, modification, and loss of dat CVE-2024-128118.8The Traveler theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.1.9 via shortcodes. This make CVE-2024-128127.5The WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting WordPress plugin before 1.13.4 is affected CVE-2024-128135.4The Open Hours – Easy Opening Hours plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'open-hours-current-