CVE-2024-3635

MediumCVSS 4.8/10Last modified Jun 17, 2026

Description

The Post Grid WordPress plugin before 7.5.0 does not sanitise and escape some of its Grid settings, which could allow high privilege users such as Editor and above to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Sep 30, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-363505.6A transient execution vulnerability in some AMD processors may allow an attacker to infer data from previous stores, potentially resulting i CVE-2024-363528.4Improper input validation in the AMD Graphics Driver could allow an attacker to supply a specially crafted pointer, potentially leading to a CVE-2024-363536.5Insufficient clearing of GPU global memory could allow a malicious process running on the same GPU to read left over memory values potential CVE-2024-363547.5Improper input validation for DIMM serial presence detect (SPD) metadata could allow an attacker with physical access, ring0 access on a sys CVE-2024-363557.0Improper input validation in the SMM handler could allow an attacker with Ring0 access to write to SMRAM and modify execution flow for S3 (s CVE-2024-363575.6A transient execution vulnerability in some AMD processors may allow an attacker to infer data in the L1D cache, potentially resulting in th CVE-2024-363587.8A link following vulnerability in Trend Micro Deep Security 20.x agents below build 20.0.1-3180 could allow a local attacker to escalate pri CVE-2024-363595.4A cross-site scripting (XSS) vulnerability in Trend Micro InterScan Web Security Virtual Appliance (IWSVA) 6.5 could allow an attacker to es CVE-2024-36365.4The Pinpoint Booking System WordPress plugin before 2.9.9.4.8 does not sanitise and escape some of its settings, which could allow high pri CVE-2024-363609.8OS command injection vulnerability exists in awkblog v0.0.1 (commit hash:7b761b192d0e0dc3eef0f30630e00ece01c8d552) and earlier. If a remote CVE-2024-363616.8Pug through 3.0.2 allows JavaScript code execution if an application accepts untrusted input for the name option of the compileClient, compi CVE-2024-363626.5In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5, 2024.03.2 path traversal allowing to read files from server was pos