CVE-2024-13926

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

The WP-Syntax WordPress plugin through 1.2 does not properly handle input, allowing an attacker to create a post containing a large number of tags, thereby exploiting a catastrophic backtracking issue in the regular expression processing to cause a DoS.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-1333

Affected software

Vendor	Product	Versions
Unknown	WP-Syntax	<= 1.2

References

https://wpscan.com/vulnerability/b5f0092e-7cd5-412f-a8ea-7bd4a8bf86d2/Exploit, Third Party Advisory

Timeline

Published: Apr 19, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-139287.2SQL injection vulnerabilities in ASPECT allow unintended access and manipulation of database repositories if session administrator credentia CVE-2024-139297.2Servlet injection vulnerabilities in ASPECT allow remote code execution if session administrator credentials become compromised. This issue CVE-2024-13935.4The Elementor Addon Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'icon_align' attribute of the Content CVE-2024-139304.9An Unchecked Loop Condition in ASPECT provides an attacker the ability to maliciously consume system resources if session administrator cred CVE-2024-139317.2Relative Path Traversal vulnerabilities in ASPECT allow access to file resources if session administrator credentials become compromised. Th CVE-2024-139338.8The FoodBakery | Delivery Restaurant Directory WordPress Theme theme for WordPress is vulnerable to Cross-Site Request Forgery in all versio CVE-2024-139397.5String::Compare::ConstantTime for Perl through 0.321 is vulnerable to timing attacks that allow an attacker to guess the length of a secret CVE-2024-13947.5A memory leak flaw was found in Golang in the RSA encrypting/decrypting code, which might lead to a resource exhaustion vulnerability using CVE-2024-139405.5The Ninja Forms Webhooks plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.0.7 via t CVE-2024-139415.3A vulnerability was found in ouch-org ouch up to 0.3.1. It has been classified as critical. This affects the function ouch::archive::zip::co CVE-2024-139427.6Secure BootROM of RK3588s SoC is vulnerable to a time-of-check to time-of-use attack in case of booting from external media (SPI NOR or NAND CVE-2024-139437.8Tesla Model S Iris Modem QCMAP_ConnectionManager Improper Input Validation Sandbox Escape Vulnerability. This vulnerability allows local att