CVE-2024-3634

MediumCVSS 4.8/10Last modified Jun 17, 2026

Description

The month name translation benaceur WordPress plugin before 2.3.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: May 15, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-363406.6A junction point vulnerability within AMD uProf can allow a local low-privileged attacker to create junction points, potentially resulting CVE-2024-363428.8Improper input validation in the GPU driver could allow an attacker to exploit a heap overflow potentially resulting in arbitrary code execu CVE-2024-363434.6Improper input validation in the System Management Mode (SMM) communications buffer could allow a privileged attacker to perform an out of b CVE-2024-363454.6Improper input validation in the AMD OverDrive (AOD) System Management Mode (SMM) module could allow a privileged attacker to perform an out CVE-2024-363466.0Improper input validation in AMD Power Management Firmware (PMFW) could allow a privileged attacker from Guest VM to send arbitrary input da CVE-2024-363476.4Improper signature verification in AMD CPU ROM microcode patch loader may allow an attacker with local administrator privilege to load malic CVE-2024-363483.8A transient execution vulnerability in some AMD processors may allow a user process to infer the control registers speculatively even if UMI CVE-2024-363493.8A transient execution vulnerability in some AMD processors may allow a user process to infer TSC_AUX even when such a read is disabled, pote CVE-2024-36354.8The Post Grid WordPress plugin before 7.5.0 does not sanitise and escape some of its Grid settings, which could allow high privilege users CVE-2024-363505.6A transient execution vulnerability in some AMD processors may allow an attacker to infer data from previous stores, potentially resulting i CVE-2024-363528.4Improper input validation in the AMD Graphics Driver could allow an attacker to supply a specially crafted pointer, potentially leading to a CVE-2024-363536.5Insufficient clearing of GPU global memory could allow a malicious process running on the same GPU to read left over memory values potential