CVE-2024-2907

MediumCVSS 6.8/10Last modified Jun 17, 2026

Description

The AGCA WordPress plugin before 7.2.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).

Metrics

CVSS 3.1 6.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:L

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Unknown	AGCA	< 7.2.2
wordpress_plugin	agca	< 7.2.2

References

https://wpscan.com/vulnerability/d2588b47-a518-4cb2-a557-2c7eaffa17e4/Exploit, Third Party Advisory
https://wpscan.com/vulnerability/d2588b47-a518-4cb2-a557-2c7eaffa17e4/Exploit, Third Party Advisory

Timeline

Published: Apr 25, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-290709.1On versions before 2.1.4, session is not invalidated after logout. When the user logged in successfully, the Backend service returns "Author CVE-2024-290718.8HGW BL1500HM Ver 002.001.013 and earlier contains a use of week credentials issue. A network-adjacent unauthenticated attacker may change th CVE-2024-290728.2A privilege escalation vulnerability exists in the Foxit Reader 2024.2.0.25138. The vulnerability occurs due to improper certification valid CVE-2024-290736.5An vulnerability in the handling of Latex exists in Ankitects Anki 24.04. When Latex is sanitized to prevent unsafe commands, the verbatim p CVE-2024-290748.8in OpenHarmony v3.2.4 and prior versions allow a local attacker arbitrary code execution in any apps through improper input.CVE-2024-290754.6Active debug code vulnerability exists in Mesh Wi-Fi router RP562B firmware version v1.0.2 and earlier. If this vulnerability is exploited, CVE-2024-290765.5Uncaught exception for some Intel(R) CST software before version 8.7.10803 may allow an authenticated user to potentially enable denial of s CVE-2024-290776.7Improper access control in some JAM STAPL Player software before version 2.6.1 may allow an authenticated user to potentially enable escalat CVE-2024-290787.5Incorrect permission assignment for critical resource issue exists in MosP kintai kanri V4.6.6 and earlier, which may allow a remote unauthe CVE-2024-290797.8Insufficient control flow management in some Intel(R) VROC software before version 8.6.0.3001 may allow an authenticated user to potentially CVE-2024-29084.3The Call Now Button WordPress plugin before 1.4.7 does not sanitise and escape some of its settings, which could allow high privilege users CVE-2024-290806.5Potential vulnerabilities have been identified in the HP Display Control software component within the HP Application Enabling Software Driv