CVE-2024-4664

MediumCVSS 4.8/10Last modified Jun 17, 2026

Description

The WP Chat App WordPress plugin before 3.6.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admins to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed.

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Unknown	WP Chat App	< 3.6.5
ninjateam	wp_chat_app	< 3.6.5

References

https://wpscan.com/vulnerability/46ada0b4-f3cd-44fb-a568-3345e639bdb6/Exploit, Third Party Advisory
https://wpscan.com/vulnerability/46ada0b4-f3cd-44fb-a568-3345e639bdb6/Exploit, Third Party Advisory

Timeline

Published: Jun 27, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-466409.8SeaCMS 13.2 has a remote code execution vulnerability located in the file sql.class.chp. Although the system has a check function, the check CVE-2024-466446.5eNMS 4.4.0 to 4.7.1 is vulnerable to Directory Traversal via edit_file.CVE-2024-466457.5eNMS 4.0.0 is vulnerable to Directory Traversal via get_tree_files.CVE-2024-466466.5eNMS up to 4.7.1 is vulnerable to Directory Traversal via /download/file.CVE-2024-466476.5eNMS 4.4.0 to 4.7.1 is vulnerable to Directory Traversal via upload_files.CVE-2024-466487.5eNMS 4.4.0 to 4.7.1 is vulnerable to Directory Traversal via scan_folder.CVE-2024-466497.5eNMS up to 4.7.1 is vulnerable to Directory Traversal via download/folder.CVE-2024-46656.4The EventPrime WordPress plugin before 3.5.0 does not properly validate permissions when updating bookings, allowing users to change/cancel CVE-2024-466529.8Tenda AC8v4 V16.03.34.06 has a stack overflow vulnerability in the fromAdvSetMacMtuWan function.CVE-2024-466544.8A stored cross-site scripting (XSS) vulnerability in the Add Scheduled Task module of Maccms10 v2024.1000.4040 allows attackers to execute a CVE-2024-466556.1A reflected cross-site scripting (XSS) vulnerability in Ellevo 6.2.0.38160 allows attackers to execute arbitrary code in the context of a us CVE-2024-466575.5Artifex Software mupdf v1.24.9 was discovered to contain a segmentation fault via the component /tools/pdfextract.c. This vulnerability allo