CVE-2024-3075

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

The MM-email2image WordPress plugin through 0.2.5 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Unknown	MM-email2image	<= 0.2.5

References

https://wpscan.com/vulnerability/450375f6-a9d4-49f6-8bab-867774372795/Exploit, Third Party Advisory
https://wpscan.com/vulnerability/450375f6-a9d4-49f6-8bab-867774372795/Exploit, Third Party Advisory

Timeline

Published: Apr 26, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-30763.8The MM-email2image WordPress plugin through 0.2.5 does not have CSRF check in some places, and is missing sanitisation as well as escaping, CVE-2024-30776.5An malicious BLE device can crash BLE victim device by sending malformed gatt packet CVE-2024-30789.8A vulnerability was found in Qdrant up to 1.6.1/1.7.4/1.8.2 and classified as critical. This issue affects some unknown processing of the fi CVE-2024-30797.2Certain models of ASUS routers have buffer overflow vulnerabilities, allowing remote attackers with administrative privileges to execute arb CVE-2024-307994.4An issue in PX4 Autopilot v1.14 and before allows a remote attacker to execute arbitrary code and cause a denial of service via the Breach R CVE-2024-30809.8Certain ASUS router models have authentication bypass vulnerability, allowing unauthenticated remote attackers to log in the device.CVE-2024-308005.6PX4 Autopilot v.1.14 allows an attacker to fly the drone into no-fly zones by breaching the geofence using flaws in the function.CVE-2024-308015.5SQL Injection vulnerability in Cloud based customer service management platform v.1.0.0 allows a local attacker to execute arbitrary code vi CVE-2024-308029.8An issue in Vehicle Management System 7.31.0.3_20230412 allows an attacker to escalate privileges via the login.html component.CVE-2024-308049.8An issue discovered in the DeviceIoControl component in ASUS Fan_Xpert before v.10013 allows an attacker to execute arbitrary code via craft CVE-2024-308066.5An issue was discovered in Bento4 v1.6.0-641-2-g1529b83. There is a heap overflow in AP4_Dec3Atom::AP4_Dec3Atom at Ap4Dec3Atom.cpp, leading CVE-2024-308077.5An issue was discovered in Bento4 v1.6.0-641-2-g1529b83. There is a heap-use-after-free in AP4_UnknownAtom::~AP4_UnknownAtom at Ap4Atom.cpp,