CVE-2024-3630

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

The HL Twitter WordPress plugin through 2014.1.18 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: May 15, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-363027.8An origin validation vulnerability in the Trend Micro Apex One security agent could allow a local attacker to escalate privileges on affecte CVE-2024-363037.8An origin validation vulnerability in the Trend Micro Apex One security agent could allow a local attacker to escalate privileges on affecte CVE-2024-363047.0A Time-of-Check Time-Of-Use vulnerability in the Trend Micro Apex One and Apex One as a Service agent could allow a local attacker to escala CVE-2024-363057.8A security agent link following vulnerability in Trend Micro Apex One could allow a local attacker to escalate privileges on affected instal CVE-2024-363065.5A link following vulnerability in the Trend Micro Apex One and Apex One as a Service Damage Cleanup Engine could allow a local attacker to c CVE-2024-363075.5A security agent link following vulnerability in Trend Micro Apex One and Apex One as a Service could allow a local attacker to disclose sen CVE-2024-36314.3The HL Twitter WordPress plugin through 2014.1.18 does not have CSRF check when unlinking twitter accounts, which could allow attackers to m CVE-2024-363104.6Improper input validation in the SMM communications buffer could allow a privileged attacker to perform an out of bounds read or write to SM CVE-2024-363114.6A Time-of-check time-of-use (TOCTOU) race condition in the SMM communications buffer could allow a privileged attacker to bypass input valid CVE-2024-363155.7Improper enforcement of the LFENCE serialization property may allow an attacker to bypass speculation barriers and potentially disclose sens CVE-2024-363165.5The integer overflow vulnerability within AMD Graphics driver could allow an attacker to bypass size checks potentially resulting in a denia CVE-2024-363196.3Debug code left active in AMD's Video Decoder Engine Firmware (VCN FW) could allow a attacker to submit a maliciously crafted command causin