CVE-2024-3919

MediumCVSS 4.6/10Last modified Jun 17, 2026

Description

The OpenPGP Form Encryption for WordPress plugin before 1.5.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.

Metrics

CVSS 3.1 4.6/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Unknown	OpenPGP Form Encryption for WordPress	< 1.5.1
erik_l._arneson	openpgp_form_encryption	< 1.5.1

References

https://wpscan.com/vulnerability/4e38c7d9-5b6a-4dfc-8f22-3ff30565ce43/Exploit, Third Party Advisory
https://wpscan.com/vulnerability/4e38c7d9-5b6a-4dfc-8f22-3ff30565ce43/Exploit, Third Party Advisory

Timeline

Published: Jul 13, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-39203.5The Flattr WordPress plugin through 1.2.2 does not sanitise and escape some of its settings, which could allow high privilege users such as CVE-2024-392028.8D-Link DIR-823X firmware - 240126 was discovered to contain a remote command execution (RCE) vulnerability via the dhcpd_startip parameter a CVE-2024-392036.1A cross-site scripting (XSS) vulnerability in the Backend Theme Management module of Z-BlogPHP v1.7.3 allows attackers to execute arbitrary CVE-2024-392059.8An issue in pyload-ng v0.5.0b3.dev85 running under python3.11 or below allows attackers to execute arbitrary code via a crafted HTTP request CVE-2024-392067.5An issue discovered in MSP360 Backup Agent v7.8.5.15 and v7.9.4.84 allows attackers to obtain network share credentials used in a backup due CVE-2024-392078.2lua-shmem v1.0-1 was discovered to contain a buffer overflow via the shmem_write function.CVE-2024-392089.8luci-app-lucky v2.8.3 was discovered to contain hardcoded credentials.CVE-2024-392096.3luci-app-sms-tool v1.9-6 was discovered to contain a command injection vulnerability via the score parameter.CVE-2024-39214.8The Gianism WordPress plugin through 5.1.0 does not sanitise and escape some of its settings, which could allow high privilege users such as CVE-2024-392107.5Best House Rental Management System v1.0 was discovered to contain an arbitrary file read vulnerability via the Page parameter at index.php.CVE-2024-392115.3Kaiten 57.128.8 allows remote attackers to enumerate user accounts via a crafted POST request, because a login response contains a user_emai CVE-2024-392198.8An issue in Aginode GigaSwitch V5 before version 7.06G allows authenticated attackers with Administrator privileges to upload an earlier fir