CVE-2024-2334

MediumCVSS 6.4/10Last modified Jun 17, 2026

Description

The Template Kit – Import plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the template upload functionality in all versions up to, and including, 1.0.14 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Metrics

CVSS 3.1 6.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-434

Affected software

No affected versions have been published.

Timeline

Published: Apr 9, 2024
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-233405.3@hono/node-server is an adapter that allows users to run Hono applications on Node.js. Since v1.3.0, @hono/node-server has used its own Requ CVE-2024-233416.1TuiTse-TsuSin is a package for organizing the comparative corpus of Taiwanese Chinese characters and Roman characters, and extracting senten CVE-2024-233427.4The `ecdsa` PyPI package is a pure Python implementation of ECC (Elliptic Curve Cryptography) with support for ECDSA (Elliptic Curve Digital CVE-2024-233446.5Tuleap is an Open Source Suite to improve management of software developments and collaboration. Some users might get access to restricted i CVE-2024-233455.4Nautobot is a Network Source of Truth and Network Automation Platform built as a web application. All users of Nautobot versions earlier th CVE-2024-233467.8Pymatgen (Python Materials Genomics) is an open-source Python library for materials analysis. A critical security vulnerability exists in th CVE-2024-233477.8Prior to v176, when opening a new project Meta Spark Studio would execute scripts defined inside of a package.json file included as part of CVE-2024-233488.8Improper input validation vulnerability in a-blog cms Ver.3.1.x series versions prior to Ver.3.1.7, Ver.3.0.x series versions prior to Ver.3 CVE-2024-233495.4Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Answer.This issue affects Apach CVE-2024-23356.4The Elements Plus! plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple widget link URLs in all versions up to, an CVE-2024-233506.5Permanent DOS when DL NAS transport receives multiple payloads such that one payload contains SOR container whose integrity check has failed CVE-2024-233517.8Memory corruption as GPU registers beyond the last protected range can be accessed through LPAC submissions.