CVE-2024-2404

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

The Better Comments WordPress plugin before 1.5.6 does not sanitise and escape some of its settings, which could allow low privilege users such as Subscribers to perform Stored Cross-Site Scripting attacks.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Apr 24, 2024
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2024

CVE-2024-240416.1A stored cross-site scripting (XSS) vulnerability in Travel Journal Using PHP and MySQL with Source Code v1.0 allows attackers to execute arCVE-2024-240428.8Directory Traversal vulnerability in Devan-Kerman ARRP v.0.8.1 and before allows a remote attacker to execute arbitrary code via the dumpDirCVE-2024-240435.5Directory Traversal vulnerability in Speedy11CZ MCRPX v.1.4.0 and before allows a local attacker to execute arbitrary code via a crafted filCVE-2024-24054.5The Float menu WordPress plugin before 6.0.1 does not have CSRF check in its bulk actions, which could allow attackers to make logged in adCVE-2024-240504.7Cross Site Scripting (XSS) vulnerability in Sourcecodester Workout Journal App 1.0 allows attackers to run arbitrary code via parameters firCVE-2024-240515.5Improper input validation of printing files in Monoprice Select Mini V2 V37.115.32 allows attackers to instruct the device's movable parts tCVE-2024-240595.4springboot-manager v1.6 is vulnerable to Arbitrary File Upload. The system does not filter the suffixes of uploaded files.CVE-2024-24069.8A vulnerability, which was classified as critical, was found in Gacjie Server up to 1.0. This affects the function index of the file /app/adCVE-2024-240605.4springboot-manager v1.6 is vulnerable to Cross Site Scripting (XSS) via /sys/user.CVE-2024-240615.4springboot-manager v1.6 is vulnerable to Cross Site Scripting (XSS) via /sysContent/add.CVE-2024-240625.4springboot-manager v1.6 is vulnerable to Cross Site Scripting (XSS) via /sys/role.CVE-2024-24085.9The openssl_private_decrypt function in PHP, when using PKCS1 padding (OPENSSL_PKCS1_PADDING, which is the default), is vulnerable to the Ma
CVE-2024-2404: Medium severity, CVSS 5.4 | Vulnix