CVE-2024-4411

MediumCVSS 6.4/10Last modified Jun 17, 2026

Description

The Mihdan: Yandex Turbo Feed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 1.6.5.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Metrics

CVSS 3.1 6.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: May 14, 2024
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-441124.3Due to missing authorization check in SAP for Oil & Gas (Transportation and Distribution), an attacker authenticated as a non-administrative CVE-2024-441134.3Due to missing authorization checks, SAP Business Warehouse (BEx Analyzer) allows an authenticated attacker to access information over the n CVE-2024-441142.7SAP NetWeaver Application Server for ABAP and ABAP Platform allow users with high privileges to execute a program that reveals data over the CVE-2024-441154.3The RFC enabled function module allows a low privileged user to add URLs to any user's workplace favourites. This vulnerability could be uti CVE-2024-441164.3The RFC enabled function module allows a low privileged user to add any workbook to any user's workplace favourites. This vulnerability coul CVE-2024-441175.4The RFC enabled function module allows a low privileged user to perform various actions, such as modifying the URLs of any user's favourite CVE-2024-44122.7The software accepts user-supplied data without sufficient validation, allowing for the injection of malicious Expression Language (EL) code CVE-2024-441204.7SAP NetWeaver Enterprise Portal is vulnerable to reflected cross site scripting due to insufficient encoding of user-controlled input. An un CVE-2024-441214.3Under certain conditions Statutory Reports in SAP S/4 HANA allows an attacker with basic privileges to access information which would otherw CVE-2024-441228.8A logic issue was addressed with improved checks. This issue is fixed in iOS 18 and iPadOS 18, macOS Sequoia 15, macOS Sonoma 14.7.1, macOS CVE-2024-441232.3A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 18 and iPadOS 18, macOS Sequoia 15. A malicious a CVE-2024-441246.5This issue was addressed through improved state management. This issue is fixed in iOS 18 and iPadOS 18. A malicious Bluetooth input device