CVE-2024-2345

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

The FileBird – WordPress Media Library Folders & File Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the folder name parameter in all versions up to, and including, 5.6.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author access or higher, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: May 2, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-234507.5A flaw was discovered in Elasticsearch, where processing a document in a deeply nested pipeline on an ingest node could cause the Elasticsea CVE-2024-234516.5Incorrect Authorization issue exists in the API key based security model for Remote Cluster Security, which is currently in Beta, in Elastic CVE-2024-234527.5Request smuggling vulnerability in HTTP server in Apache bRPC 0.9.5~1.7.0 on all platforms allows attacker to smuggle request. Vulnerabilit CVE-2024-234535.5Android Spoon application version 7.11.1 to 8.6.0 uses hard-coded credentials, which may allow a local attacker to retrieve the hard-coded A CVE-2024-234546.2Apache Hadoop’s RunJar.run() does not set permissions for temporary directory by default. If sensitive data will be present in this file, al CVE-2024-234567.5Anti-tampering can be disabled under certain conditions without signature validation. This affects Zscaler Client Connector <4.2.0.190 with CVE-2024-234577.8The anti-tampering functionality of the Zscaler Client Connector can be disabled under certain conditions when an uninstall password is enfo CVE-2024-234587.8While copying individual autoupdater log files, reparse point check was missing which could result into crafted attacks, potentially leading CVE-2024-234599.8An Improper Link Resolution Before File Access ('Link Following') vulnerability in Zscaler Client Connector on Mac allows a system file to b CVE-2024-23465.4The FileBird – WordPress Media Library Folders & File Manager plugin for WordPress is vulnerable to Insecure Direct Object Reference in all CVE-2024-234607.8The Zscaler Updater process does not validate the digital signature of the installer before execution, allowing arbitrary code to be locally CVE-2024-234615.5An Improper Validation of Integrity Check Value vulnerability in Zscaler Client Connector on MacOS during the upgrade process may allow a Lo