CVE-2024-4706

MediumCVSS 6.4/10Last modified Jun 17, 2026

Description

The WordPress + Microsoft Office 365 / Azure AD | LOGIN plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'pintra' shortcode in all versions up to, and including, 27.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Metrics

CVSS 3.1 6.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: May 23, 2024
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-470606.5Zitadel is an open source identity management platform. In Zitadel, even after an organization is deactivated, associated projects, respecti CVE-2024-470618.3Plate is a javascript toolkit that makes it easier for you to develop with Slate, a popular framework for building text editors. One longsta CVE-2024-470628.8Navidrome is an open source web-based music collection server and streamer. Navidrome automatically adds parameters in the URL to SQL querie CVE-2024-470636.1Computer Vision Annotation Tool (CVAT) is an interactive video and image annotation tool for computer vision. If a malicious CVAT user with CVE-2024-470646.1Computer Vision Annotation Tool (CVAT) is an interactive video and image annotation tool for computer vision. If an attacker can trick a log CVE-2024-470656.5Meshtastic is an open source mesh networking solution. Prior to 2.5.1, traceroute responses from the remote node are not rate limited. Given CVE-2024-470668.8Lobe Chat is an open-source artificial intelligence chat framework. Prior to version 1.19.13, server-side request forgery protection impleme CVE-2024-470676.1AList is a file list program that supports multiple storages. AList contains a reflected cross-site scripting vulnerability in helper.go. Th CVE-2024-470686.1Rollup is a module bundler for JavaScript. Versions prior to 2.79.2, 3.29.5, and 4.22.4 are susceptible to a DOM Clobbering vulnerability wh CVE-2024-470696.1Oveleon Cookie Bar is a cookie bar is for the Contao Open Source CMS and allows a visitor to define cookie & privacy settings for the websit CVE-2024-47075.4The Materialis Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's materialis_contact_form shortcod CVE-2024-470709.0authentik is an open-source identity provider. A vulnerability that exists in versions prior to 2024.8.3 and 2024.6.5 allows bypassing passw