CVE-2024-4616

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

The Widget Bundle WordPress plugin through 2.0.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against only unauthenticated users

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Unknown	Widget Bundle	<= 2.0.0
devnath_verma	widget_bundle	<= 2.0.0

References

https://wpscan.com/vulnerability/d203bf3b-aee9-4755-b429-d6bbdd940890/Exploit, Third Party Advisory
https://wpscan.com/vulnerability/d203bf3b-aee9-4755-b429-d6bbdd940890/Exploit, Third Party Advisory

Timeline

Published: Jun 21, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-46176.4The Rank Math SEO with AI Best SEO Tools plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ parameter in version CVE-2024-46185.4The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Team Member widget in all versi CVE-2024-46195.4The Elementor Website Builder – More than Just a Page Builder plugin for WordPress is vulnerable to DOM-Based Stored Cross-Site Scripting vi CVE-2024-46209.8The ARForms - Premium WordPress Form Builder Plugin WordPress plugin before 6.6 allows unauthenticated users to modify uploaded files in suc CVE-2024-462095.4A stored cross-site scripting (XSS) vulnerability in the component /media/test.html of REDAXO CMS v5.17.1 allows attackers to execute arbitr CVE-2024-46214.8The ARForms - Premium WordPress Form Builder Plugin WordPress plugin before 6.6 does not sanitise and escape some of its settings, which cou CVE-2024-462107.2An arbitrary file upload vulnerability in the MediaPool module of Redaxo CMS v5.17.1 allows attackers to execute arbitrary code via uploadin CVE-2024-462124.9An issue in the component /index.php?page=backup/export of REDAXO CMS v5.17.1 allows attackers to execute a directory traversal.CVE-2024-462137.2REDAXO CMS v2.11.0 was discovered to contain a remote code execution (RCE) vulnerability.CVE-2024-462156.5A vulnerability was discovered in KM08-708H-v1.1, There is a buffer overflow in the sub_445BDC() function within the /usr/sbin/goahead progr CVE-2024-46228.3If misconfigured, alpitronic Hypercharger EV charging devices can expose a web interface protected by authentication. If the default creden CVE-2024-462264.8A stored cross site scripting (XSS) vulnerability in HelpDeskZ < v2.0.2 allows remote attackers to execute arbitrary JavaScript in the admin