CVE-2024-2475

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

The Media Library Assistant plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 3.13 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Mar 29, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-247506.5Undici is an HTTP/1.1 client, written from scratch for Node.js. In affected versions calling `fetch(url)` and not consuming the incoming bod CVE-2024-247518.8sf_event_mgt is an event management and registration extension for the TYPO3 CMS based on ExtBase and Fluid. In affected versions the existi CVE-2024-247526.5Bref enable serverless PHP on AWS Lambda. When Bref is used with the Event-Driven Function runtime and the handler is a `RequestHandlerInter CVE-2024-247536.5Bref enable serverless PHP on AWS Lambda. When Bref is used in combination with an API Gateway with the v2 format, it does not handle multip CVE-2024-247549.8Bref enable serverless PHP on AWS Lambda. When Bref is used with the Event-Driven Function runtime and the handler is a `RequestHandlerInter CVE-2024-247555.3discourse-group-membership-ip-block is a discourse plugin that adds support for adding users to groups based on their IP address. discourse-CVE-2024-247567.5Crafatar serves Minecraft avatars based on the skin for use in external applications. Files outside of the `lib/public/` directory can be re CVE-2024-247579.8open-irs is an issue response robot that reponds to issues in the installed repository. The `.env` file was accidentally uploaded when worki CVE-2024-247584.5Undici is an HTTP/1.1 client, written from scratch for Node.js. Undici already cleared Authorization headers on cross-origin redirects, but CVE-2024-247599.1MindsDB is a platform for building artificial intelligence from enterprise data. Prior to version 23.12.4.2, a threat actor can bypass the s CVE-2024-24764.3The OceanWP theme for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the load_theme_panel_pane CVE-2024-247607.3mailcow is a dockerized email package, with multiple containers linked in one bridged network. A security vulnerability has been identified