CVE-2024-3823

LowCVSS 2.4/10Last modified Jul 29, 2026

Description

The Base64 Encoder/Decoder WordPress plugin through 0.9.2 does not have CSRF check when updating its settings, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack

Metrics

CVSS 3.1 2.4/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-352

Affected software

No affected versions have been published.

Timeline

Published
May 15, 2024
Last modified
Jul 29, 2026
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-382307.5Windows Standards-Based Storage Management Service Denial of Service VulnerabilityCVE-2024-382317.5Windows Remote Desktop Licensing Service Denial of Service VulnerabilityCVE-2024-382327.5Windows Networking Denial of Service VulnerabilityCVE-2024-382337.5Windows Networking Denial of Service VulnerabilityCVE-2024-382346.5Windows Networking Denial of Service VulnerabilityCVE-2024-382356.5Windows Hyper-V Denial of Service VulnerabilityCVE-2024-382367.5DHCP Server Service Denial of Service VulnerabilityCVE-2024-382377.8Kernel Streaming WOW Thunk Service Driver Elevation of Privilege VulnerabilityCVE-2024-382387.8Kernel Streaming Service Driver Elevation of Privilege VulnerabilityCVE-2024-382397.2Windows Kerberos Elevation of Privilege VulnerabilityCVE-2024-38245.5The Base64 Encoder/Decoder WordPress plugin through 0.9.2 does not have CSRF check in place when resetting its settings, which could allow aCVE-2024-382409.8Windows Remote Access Connection Manager Elevation of Privilege Vulnerability
CVE-2024-3823: Low severity, CVSS 2.4 | Vulnix