CVE-2024-2457

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

The Modal Window – create popup modal window plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 5.3.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Apr 9, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-245706.1Statamic is a Laravel and Git powered CMS. HTML files crafted to look like jpg files are able to be uploaded, allowing for XSS. This affects CVE-2024-245715.4facileManager is a modular suite of web apps built with the sysadmin in mind. For the facileManager web application versions 4.5.0 and earli CVE-2024-245726.5facileManager is a modular suite of web apps built with the sysadmin in mind. In versions 4.5.0 and earlier, the $_REQUEST global array was CVE-2024-245738.8facileManager is a modular suite of web apps built with the sysadmin in mind. In versions 4.5.0 and earlier, when a user updates their profi CVE-2024-245746.1phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. Unsafe echo of filename in phpMyFAQ\p CVE-2024-245757.5libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functi CVE-2024-2457610.0Rust is a programming language. The Rust Security Response WG was notified that the Rust standard library prior to version 1.77.2 did not pr CVE-2024-245779.8libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functi CVE-2024-245789.8RaspberryMatic is an open-source operating system for HomeMatic internet-of-things devices. RaspberryMatic / OCCU prior to version 3.75.6.20 CVE-2024-245799.8stereoscope is a go library for processing container images and simulating a squash filesystem. Prior to version 0.0.1, it is possible to c CVE-2024-24585.4The Powerkit – Supercharge your WordPress Site plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes CVE-2024-245805.5Improper conditions check in some Intel(R) Data Center GPU Max Series 1100 and 1550 products may allow a privileged user to potentially enab