First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2024-3580

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

The Popup4Phone WordPress plugin through 1.3.2 does not sanitise and escape some of its settings, which could allow high privilege users such as Editor to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

Affected software

Vendor	Product	Versions
Unknown	Popup4Phone	<= 1.3.2

References

https://wpscan.com/vulnerability/31f401c4-735a-4efb-b81f-ab98c00c526b/Exploit, Third Party Advisory
https://wpscan.com/vulnerability/31f401c4-735a-4efb-b81f-ab98c00c526b/Exploit, Third Party Advisory

Timeline

Published: May 17, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-358005.5In the Linux kernel, the following vulnerability has been resolved: efi: fix panic in kdump kernel Check if get_next_variable() is actuall CVE-2024-358015.5In the Linux kernel, the following vulnerability has been resolved: x86/fpu: Keep xfd_state in sync with MSR_IA32_XFD Commit 672365477ae8 CVE-2024-358035.5In the Linux kernel, the following vulnerability has been resolved: x86/efistub: Call mixed mode boot services on the firmware's stack Nor CVE-2024-358045.5In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Mark target gfn of emulated atomic instruction as dirty When CVE-2024-358055.5In the Linux kernel, the following vulnerability has been resolved: dm snapshot: fix lockup in dm_exception_table_exit There was reported CVE-2024-358065.5In the Linux kernel, the following vulnerability has been resolved: soc: fsl: qbman: Always disable interrupts when taking cgr_lock smp_ca CVE-2024-358075.5In the Linux kernel, the following vulnerability has been resolved: ext4: fix corruption during on-line resize We observed a corruption du CVE-2024-358085.5In the Linux kernel, the following vulnerability has been resolved: md/dm-raid: don't call md_reap_sync_thread() directly Currently md_rea CVE-2024-358094.7In the Linux kernel, the following vulnerability has been resolved: PCI/PM: Drain runtime-idle callbacks before driver removal A race cond CVE-2024-35814.3The MaxGalleria plugin for WordPress is vulnerable to unauthorized image upload due to a missing capability check on the add_media_library_i CVE-2024-358105.5In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Fix the lifetime of the bo cursor memory The cleanup can b CVE-2024-358115.5In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: Fix use-after-free bug in brcmf_cfg80211_detach This i