CVE-2024-39310

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

The Basil recipe theme for WordPress is vulnerable to Persistent Cross-Site Scripting (XSS) via the `post_title` parameter in versions up to, and including, 2.0.4 due to insufficient input sanitization and output escaping. This vulnerability allows authenticated attackers with contributor-level access and above to inject arbitrary web scripts in pages that will execute whenever a user accesses a compromised page. Because the of the default WordPress validation, it is not possible to insert the payload directly but if the Cooked plugin is installed, it is possible to create a recipe post type (cp_recipe) and inject the payload in the title field. Version 2.0.5 contains a patch for the issue.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Jul 1, 2024
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-393115.4Publify is a self hosted Web publishing platform on Rails. Prior to version 10.0.1 of Publify, corresponding to versions prior to 10.0.2 of CVE-2024-393125.3Botan is a C++ cryptography library. X.509 certificates can identify elliptic curves using either an object identifier or using explicit enc CVE-2024-393135.3toy-blog is a headless content management system implementation. Starting in version 0.5.4 and prior to version 0.6.1, articles with private CVE-2024-393144.7toy-blog is a headless content management system implementation. Starting in version 0.4.3 and prior to version 0.5.0, the administrative pa CVE-2024-393156.5Pomerium is an identity and context-aware access proxy. Prior to version 0.26.1, the Pomerium user info page (at `/.pomerium`) unintentional CVE-2024-393166.5Rack is a modular Ruby web server interface. Starting in version 3.1.0 and prior to version 3.1.5, Regular Expression Denial of Service (ReD CVE-2024-393174.9Wagtail is an open source content management system built on Django. A bug in Wagtail's `parse_query_string` would result in it taking a lon CVE-2024-393185.4The Ibexa Admin UI Bundle contains all the necessary parts to run the Ibexa DXP Back Office interface. The file upload widget is vulnerable CVE-2024-393195.3aimeos/ai-controller-frontend is the Aimeos frontend controller package for e-commerce projects. Prior to versions 2024.4.2, 2023.10.9, 2022 CVE-2024-39323.1A vulnerability classified as problematic has been found in Totara LMS up to 18.7. This affects an unknown part of the component User Select CVE-2024-393206.1Discourse is an open source discussion platform. Prior to 3.2.5 and 3.3.0.beta5, the vulnerability allows an attacker to inject iframes from CVE-2024-393217.5Traefik is an HTTP reverse proxy and load balancer. Versions prior to 2.11.6, 3.0.4, and 3.1.0-rc3 have a vulnerability that allows bypassin