CVE-2024-3827

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

The Spectra Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via block ids in all versions up to, and including, 1.1.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Aug 2, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-382706.5An insufficient entropy vulnerability caused by the improper use of a randomness function with low entropy for web authentication tokens gen CVE-2024-382714.8There exists a vulnerability in Quick Share/Nearby, where an attacker can force a victim to stay connected to a temporary hotspot created fo CVE-2024-382724.3There exists a vulnerability in Quick Share/Nearby, where an attacker can bypass the accept file dialog on Quick Share Windows. Normally in CVE-2024-382735.4Insufficient capability checks meant it was possible for users to gain access to BigBlueButton join URLs they did not have permission to acc CVE-2024-382746.1Insufficient escaping of calendar event titles resulted in a stored XSS risk in the event deletion prompt.CVE-2024-382757.5The cURL wrapper in Moodle retained the original request headers when following redirects, so HTTP authorization header information could be CVE-2024-382768.8Incorrect CSRF token checks resulted in multiple CSRF risks.CVE-2024-382775.4A unique key should be generated for a user's QR login key and their auto-login key, so the same key cannot be used interchangeably between CVE-2024-382786.6A vulnerability has been identified in RUGGEDCOM RMC8388 V5.X (All versions < V5.9.0), RUGGEDCOM RMC8388NC V5.X (All versions < V5.9.0), RUG CVE-2024-382794.6The affected product is vulnerable to an attacker modifying the bootloader by using custom arguments to bypass authentication and gain acces CVE-2024-38288.8The Spectra Pro plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.1.5. This is due to the p CVE-2024-382804.6An unauthorized user is able to gain access to sensitive data, including credentials, by physically retrieving the hard disk of the product