CVE-2024-2128

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

The EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's embed widget in all versions up to, and including, 3.9.10 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Mar 7, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-212808.1Vulnerability in the Oracle Service Contracts product of Oracle E-Business Suite (component: Authoring). Supported versions that are affect CVE-2024-212815.3Vulnerability in the Oracle Banking Liquidity Management product of Oracle Financial Services Applications (component: Infrastructure). Th CVE-2024-212828.1Vulnerability in the Oracle Financials product of Oracle E-Business Suite (component: Common Components). Supported versions that are affec CVE-2024-212838.1Vulnerability in the PeopleSoft Enterprise HCM Global Payroll Core product of Oracle PeopleSoft (component: Global Payroll for Core). Suppo CVE-2024-212847.1Vulnerability in the Oracle Banking Liquidity Management product of Oracle Financial Services Applications (component: Reports). The suppo CVE-2024-212857.1Vulnerability in the Oracle Banking Liquidity Management product of Oracle Financial Services Applications (component: Reports). The suppo CVE-2024-212865.4Vulnerability in the PeopleSoft Enterprise ELM Enterprise Learning Management product of Oracle PeopleSoft (component: Enterprise Learning M CVE-2024-212877.5Vulnerability in the Oracle Agile PLM Framework product of Oracle Supply Chain (component: Software Development Kit, Process Extension). T CVE-2024-21295.4The WPBITS Addons For Elementor Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's heading widg CVE-2024-21305.4The CWW Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Module2 widget in all versions up to, and includ CVE-2024-213026.7Summary: As of July 8, 2025 Microsoft has completed mitigations to address this vulnerability. See KB5042562: Guidance for blocking rollback CVE-2024-213038.8SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability