CVE-2024-4899

MediumCVSS 5.0/10Last modified Jun 17, 2026

Description

The SEOPress WordPress plugin before 7.8 does not sanitise and escape some of its Post settings, which could allow high privilege users such as contributor to perform Stored Cross-Site Scripting attacks.

Metrics

CVSS 3.1 5.0/10CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Jun 24, 2024
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-489907.8Qualys discovered that needrestart, before version 3.8, allows local attackers to execute arbitrary code as root by tricking needrestart intCVE-2024-489917.8Qualys discovered that needrestart, before version 3.8, allows local attackers to execute arbitrary code as root by winning a race conditionCVE-2024-489927.8Qualys discovered that needrestart, before version 3.8, allows local attackers to execute arbitrary code as root by tricking needrestart intCVE-2024-489938.8SQL Server Native Client Remote Code Execution VulnerabilityCVE-2024-489948.8SQL Server Native Client Remote Code Execution VulnerabilityCVE-2024-489958.8SQL Server Native Client Remote Code Execution VulnerabilityCVE-2024-489968.8SQL Server Native Client Remote Code Execution VulnerabilityCVE-2024-489978.8SQL Server Native Client Remote Code Execution VulnerabilityCVE-2024-489988.8SQL Server Native Client Remote Code Execution VulnerabilityCVE-2024-489998.8SQL Server Native Client Remote Code Execution VulnerabilityCVE-2024-49006.1The SEOPress WordPress plugin before 7.8 does not validate and escape one of its Post settings, which could allow contributor and above rolCVE-2024-490008.8SQL Server Native Client Remote Code Execution Vulnerability
CVE-2024-4899: Medium severity, CVSS 5.0 | Vulnix