CVE-2024-32744

MediumCVSS 4.6/10Last modified Jun 17, 2026

Description

A cross-site scripting (XSS) vulnerability in the Settings section of WonderCMS v3.4.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the PAGE KEYWORDS parameter under the CURRENT PAGE module.

Metrics

CVSS 3.1 4.6/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Apr 17, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-327455.9A cross-site scripting (XSS) vulnerability in the Settings section of WonderCMS v3.4.3 allows attackers to execute arbitrary web scripts or CVE-2024-327464.6A cross-site scripting (XSS) vulnerability in the Settings section of WonderCMS v3.4.3 allows attackers to execute arbitrary web scripts or CVE-2024-32754.3The eRoom – Zoom Meetings & Webinars plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and includi CVE-2024-327529.1The iSTAR door controllers running firmware prior to version 6.6.B, does not support authenticated communications with ICU, which may allow CVE-2024-327537.0Under certain circumstances the camera may be susceptible to known vulnerabilities associated with the JQuery versions prior to 3.5.0 third-CVE-2024-327543.1Under certain circumstances, when the controller is in factory reset mode waiting for initial setup, it will broadcast its MAC address, seri CVE-2024-327559.1Under certain circumstances the web interface will accept characters unrelated to the expected input.CVE-2024-327566.8Under certain circumstances the Linux users credentials may be recovered by an authenticated user.CVE-2024-327576.8Under certain circumstances unnecessary user details are provided within system logs CVE-2024-327587.5Under certain circumstances the communication between exacqVision Client and exacqVision Server will use insufficient key length and exchang CVE-2024-327597.7Under certain circumstances the Software House C●CURE 9000 installer will utilize weak credentials.CVE-2024-32764.8The Lightbox & Modal Popup WordPress Plugin WordPress plugin before 2.7.28, foobox-image-lightbox-premium WordPress plugin before 2.7.28 do