CVE-2024-2477

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

The wpDiscuz plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Alternative Text' field of an uploaded image in all versions up to, and including, 7.6.15 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Apr 23, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-247705.3vantage6 is an open source framework built to enable, manage and deploy privacy enhancing technologies like Federated Learning and Multi-Par CVE-2024-247715.9Open Forms allows users create and publish smart forms. Versions prior to 2.2.9, 2.3.7, 2.4.5, and 2.5.2 contain a non-exploitable multi-fac CVE-2024-247724.3A guest user could exploit a chart data REST API and send arbitrary SQL statements that on error could leak information from the underlying CVE-2024-247736.5Improper parsing of nested SQL statements on SQLLab would allow authenticated users to surpass their data authorization scope. This issue af CVE-2024-247744.1Mattermost Jira Plugin handling subscriptions fails to check the security level of an incoming issue or limit it based on the user who creat CVE-2024-247757.5When a virtual server is enabled with VLAN group and SNAT listener is configured, undisclosed traffic can cause the Traffic Management Micro CVE-2024-247764.3Mattermost fails to check the required permissions in the POST /api/v4/channels/stats/member_count API resulting in channel member counts be CVE-2024-247778.8A cross-site request forgery (CSRF) vulnerability exists in the Web Application functionality of the LevelOne WBR-6012 R0.40e6. A specially CVE-2024-247786.5Improper privilege management in a REST interface allowed registered users to access unauthorized resources if the resource ID was know. CVE-2024-247796.5Apache Superset with custom roles that include `can write on dataset` and without all data access permissions, allows for users to create vi CVE-2024-24789.8A vulnerability was found in BradWenqiang HR 2.0. It has been rated as critical. Affected by this issue is the function selectAll of the fil CVE-2024-247809.8Remote Code Execution with untrusted URI of UDF vulnerability in Apache IoTDB. The attacker who has privilege to create UDF can register mal