CVE-2024-3814

MediumCVSS 4.8/10Last modified Jun 17, 2026

Description

The tagDiv Composer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'single' module in all versions up to, and including, 4.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Jun 15, 2024
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2024

CVE-2024-381409.8Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution VulnerabilityCVE-2024-381417.8Windows Ancillary Function Driver for WinSock Elevation of Privilege VulnerabilityCVE-2024-381427.8Windows Secure Kernel Mode Elevation of Privilege VulnerabilityCVE-2024-381434.2Windows WLAN AutoConfig Service Elevation of Privilege VulnerabilityCVE-2024-381448.8Kernel Streaming WOW Thunk Service Driver Elevation of Privilege VulnerabilityCVE-2024-381457.5Windows Layer-2 Bridge Network Driver Denial of Service VulnerabilityCVE-2024-381467.5Windows Layer-2 Bridge Network Driver Denial of Service VulnerabilityCVE-2024-381477.8Microsoft DWM Core Library Elevation of Privilege VulnerabilityCVE-2024-381487.5Windows Secure Channel Denial of Service VulnerabilityCVE-2024-381497.5BranchCache Denial of Service VulnerabilityCVE-2024-38154.8The Newspaper theme for WordPress is vulnerable to Stored Cross-Site Scripting via attachment meta in the archive page in all versions up toCVE-2024-381507.8Windows DWM Core Library Elevation of Privilege Vulnerability