CVE-2024-4703

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

The One Page Express Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's one_page_express_contact_form shortcode in all versions up to, and including, 1.6.37 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Jun 7, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-470305.1Android before 2024-10-05 on Google Pixel devices allows information disclosure in the ACPM component, A-315191818.CVE-2024-470317.4Android before 2024-10-05 on Google Pixel devices allows privilege escalation in the ABL component, A-329163861.CVE-2024-470327.8In construct_transaction_from_cmd of lwis_ioctl.c, there is a possible out of bounds write due to a heap buffer overflow. This could lead to CVE-2024-470337.8In lwis_allocator_free of lwis_allocator.c, there is a possible memory corruption due to a use after free. This could lead to local escalati CVE-2024-470345.5there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional exe CVE-2024-470357.8In vring_init of external/headers/include/virtio/virtio_ring.h, there is a possible out of bounds write due to a logic error in the code. Th CVE-2024-470387.8In dhd_prot_flowrings_pool_release of dhd_msgbuf.c, there is a possible outcof bounds write due to a missing bounds check. This could lead t CVE-2024-470395.5In isSlotMarkedSuccessful of BootControl.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to local CVE-2024-47046.1The Contact Form 7 WordPress plugin before 5.9.5 has an open redirect that allows an attacker to utilize a false URL and redirect to the URL CVE-2024-470407.8There is a possible UAF due to a logic error in the code. This could lead to local escalation of privilege with no additional execution priv CVE-2024-470417.8In valid_address of syscall.c, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local escalation CVE-2024-470435.3Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x could enable an attacker to correlate a device serial number and the user's