CVE-2024-4756

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

The WP Backpack WordPress plugin through 2.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Unknown	WP Backpack	<= 2.1
wp-backpack	wp_backpack	<= 2.1

References

https://wpscan.com/vulnerability/ce4688b6-6713-43b5-aa63-8a3b036bd332/Exploit, Third Party Advisory
https://wpscan.com/vulnerability/ce4688b6-6713-43b5-aa63-8a3b036bd332/Exploit, Third Party Advisory

Timeline

Published: Jun 7, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-475607.8RevoWorks Cloud Client 3.0.91 and earlier contains an incorrect authorization vulnerability. If this vulnerability is exploited, unintended CVE-2024-475617.3Schema parsing in the Java SDK of Apache Avro 1.11.3 and previous versions allows bad actors to execute arbitrary code. Users are recommende CVE-2024-475628.8A vulnerability has been identified in SINEC Security Monitor (All versions < V4.9.0). The affected application does not properly neutralize CVE-2024-475635.3A vulnerability has been identified in SINEC Security Monitor (All versions < V4.9.0). The affected application does not properly validate a CVE-2024-475654.3A vulnerability has been identified in SINEC Security Monitor (All versions < V4.9.0). The affected application does not properly validate t CVE-2024-475666.0A improper limitation of a pathname to a restricted directory ('path traversal') [CWE-23] in Fortinet FortiRecorder version 7.2.0 through 7.CVE-2024-475694.3A insertion of sensitive information into sent data vulnerability in Fortinet FortiMail 7.4.0 through 7.4.2, FortiMail 7.2.0 through 7.2.6, CVE-2024-47578.1The Logo Manager For Enamad WordPress plugin through 0.7.0 does not have CSRF check in some places, and is missing sanitisation as well as e CVE-2024-475706.6An insertion of sensitive information into log file vulnerability [CWE-532] in FortiOS 7.4.0 through 7.4.3, 7.2.0 through 7.2.7, 7.0 all ver CVE-2024-475719.8An operation on a resource after expiration or release in Fortinet FortiManager 6.4.12 through 7.4.0 allows an attacker to gain improper acc CVE-2024-475728.0An improper neutralization of formula elements in a csv file in Fortinet FortiSOAR 7.2.1 through 7.4.1 allows attacker to execute unauthoriz CVE-2024-475736.5An improper validation of integrity check value vulnerability [CWE-354] in FortiNDR version 7.4.2 and below, version 7.2.1 and below, versio