CVE-2024-3246

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

The LiteSpeed Cache plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.2.0.1. This is due to missing or incorrect nonce validation. This makes it possible for unauthenticated attackers to update the token setting and inject malicious JavaScript via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-352

Affected software

No affected versions have been published.

Timeline

Published: Jul 24, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-324609.8FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based based clients using `/bpp:32` legacy `GDI` drawing path with CVE-2024-324618.8LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. A SQL injection vulnerability in POST /search/search=packages in CVE-2024-324628.4Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. in versions before 1.10.9, 1.12.9, 1.14 CVE-2024-324637.1phlex is an open source framework for building object-oriented views in Ruby. There is a potential cross-site scripting (XSS) vulnerability CVE-2024-324646.1Action Text brings rich text content and editing to Rails. Instances of ActionText::Attachable::ContentAttachment included within a rich_tex CVE-2024-324657.8Git is a revision control system. The Git project recommends to avoid working in untrusted repositories, and instead to clone it first with CVE-2024-324664.3Tolgee is an open-source localization platform. For the `/v2/projects/translations` and `/v2/projects/{projectId}/translations` endpoints, t CVE-2024-324676.5MeterSphere is an open source continuous testing platform. Prior to version 2.10.14-lts, members without space permissions can view member i CVE-2024-324685.4Deno is a runtime for JavaScript and TypeScript written in rust. Several cross-site scripting vulnerabilities existed in the `deno_doc` crat CVE-2024-324697.1Decidim is a participatory democracy framework. The pagination feature used in searches and filters is subject to potential XSS attack throu CVE-2024-32475.5In Xpdf 4.05 (and earlier), a PDF object loop in an object stream leads to infinite recursion and a stack overflow.CVE-2024-324706.5Tolgee is an open-source localization platform. When API key created by admin user is used it bypasses the permission check at all. This err