CVE-2024-4755

MediumCVSS 4.8/10Last modified Jun 17, 2026

Description

The Google CSE WordPress plugin through 1.0.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Jun 21, 2024
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2024

CVE-2024-475506.7Incorrect default permissions for some Endurance Gaming Mode software installers may allow an authenticated user to potentially enable escalCVE-2024-475529.8Deserialization of Untrusted Data vulnerability in Apache Seata (incubating). This issue affects Apache Seata (incubating): from 2.0.0 CVE-2024-475539.9A vulnerability has been identified in SINEC Security Monitor (All versions < V4.9.0). The affected application does not properly validate uCVE-2024-475544.3Uncontrolled Resource Consumption vulnerability in Apache Commons IO. The org.apache.commons.io.input.XmlStreamReader class may excessivelyCVE-2024-475558.3Missing Authentication - User & System ConfigurationCVE-2024-475569.8Pre-Auth RCE via Path TraversalCVE-2024-475579.8Pre-Auth RCE via Path TraversalCVE-2024-475588.8Authenticated RCE via Path TraversalCVE-2024-475598.8Authenticated RCE via Path TraversalCVE-2024-47565.4The WP Backpack WordPress plugin through 2.1 does not sanitise and escape some of its settings, which could allow high privilege users such CVE-2024-475607.8RevoWorks Cloud Client 3.0.91 and earlier contains an incorrect authorization vulnerability. If this vulnerability is exploited, unintended CVE-2024-475617.3Schema parsing in the Java SDK of Apache Avro 1.11.3 and previous versions allows bad actors to execute arbitrary code. Users are recommende