CVE-2024-4939

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

The Weaver Xtreme Theme Support plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's div shortcode in all versions up to, and including, 6.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Jun 5, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-493907.3Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Files (Windows) before bui CVE-2024-493917.3Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Files (Windows) before bui CVE-2024-493924.8Stored cross-site scripting (XSS) vulnerability on enrollment invitation page. The following products are affected: Acronis Cyber Files (Win CVE-2024-493936.5In neomutt and mutt, the To and Cc email headers are not validated by cryptographic signing which allows an attacker that intercepts a messa CVE-2024-493945.3In mutt and neomutt the In-Reply-To email header field is not protected by cryptographic signing which allows an attacker to reuse an unencr CVE-2024-493955.3In mutt and neomutt, PGP encryption does not use the --hidden-recipient mode which may leak the Bcc email header field by inferring from the CVE-2024-493968.7The affected product is vulnerable due to insufficiently protected credentials, which may allow an attacker to impersonate Elvaco and send f CVE-2024-493979.2The affected product is vulnerable to a cross-site scripting attack which may allow an attacker to bypass authentication and takeover admin CVE-2024-493988.8The affected product is vulnerable to unrestricted file uploads, which may allow an attacker to remotely execute code.CVE-2024-493998.7The affected product is vulnerable to an attacker being able to use commands without providing a password which may allow an attacker to lea CVE-2024-49406.1An open redirect vulnerability exists in the gradio-app/gradio, affecting the latest version. The vulnerability allows an attacker to redire CVE-2024-494009.8Tacquito prior to commit 07b49d1358e6ec0b5aa482fcd284f509191119e2 was not properly performing regex matches on authorized commands and argum