CVE-2024-5039

MediumCVSS 6.4/10Last modified Jun 17, 2026

Description

The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 1.3.5.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Metrics

CVSS 3.1 6.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
May 29, 2024
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2024

CVE-2024-503909.8A command injection vulnerability has been reported to affect QHora. If exploited, the vulnerability could allow remote attackers to executeCVE-2024-503939.8A command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could CVE-2024-503948.8An improper certificate validation vulnerability has been reported to affect Helpdesk. If exploited, the vulnerability could allow remote atCVE-2024-503958.8An authorization bypass through user-controlled key vulnerability has been reported to affect Media Streaming add-on. If exploited, the vulnCVE-2024-503968.8A use of externally-controlled format string vulnerability has been reported to affect several QNAP operating system versions. If exploited,CVE-2024-503978.8A use of externally-controlled format string vulnerability has been reported to affect several QNAP operating system versions. If exploited,CVE-2024-503987.2A use of externally-controlled format string vulnerability has been reported to affect several QNAP operating system versions. If exploited,CVE-2024-503997.2A use of externally-controlled format string vulnerability has been reported to affect several QNAP operating system versions. If exploited,CVE-2024-50407.8There are multiple ways in LCDS LAquis SCADA for an attacker to access locations outside of their own directory.CVE-2024-504007.2A use of externally-controlled format string vulnerability has been reported to affect several QNAP operating system versions. If exploited,CVE-2024-504017.2A use of externally-controlled format string vulnerability has been reported to affect several QNAP operating system versions. If exploited,CVE-2024-504027.2A use of externally-controlled format string vulnerability has been reported to affect several QNAP operating system versions. If exploited,
CVE-2024-5039: Medium severity, CVSS 6.4 | Vulnix