CVE-2024-5151

HighCVSS 7.1/10Last modified Jun 17, 2026

Description

The SULly WordPress plugin before 4.3.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Weakness enumeration

CWE-79

Affected software

VendorProductVersions
UnknownSULly< 4.3.1
toolstacksully< 4.3.1

References

Timeline

Published
Jul 13, 2024
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-515105.5Out-of-bounds access vulnerability in the logo module Impact: Successful exploitation of this vulnerability may affect service confidentialiCVE-2024-515115.5Vulnerability of parameter type not being verified in the WantAgent module Impact: Successful exploitation of this vulnerability may affect CVE-2024-515125.5Vulnerability of parameter type not being verified in the WantAgent module Impact: Successful exploitation of this vulnerability may affect CVE-2024-515135.5Vulnerability of processes not being fully terminated in the VPN module Impact: Successful exploitation of this vulnerability will affect poCVE-2024-515145.5Vulnerability of pop-up windows belonging to no app in the VPN module Impact: Successful exploitation of this vulnerability may affect servCVE-2024-515154.7Race condition vulnerability in the kernel network module Impact:Successful exploitation of this vulnerability may affect availability.CVE-2024-515165.5Permission control vulnerability in the ability module Impact: Successful exploitation of this vulnerability may cause features to function CVE-2024-515175.5Vulnerability of improper memory access in the phone service module Impact: Successful exploitation of this vulnerability may affect availabCVE-2024-515187.5Vulnerability of message types not being verified in the advanced messaging modul Impact: Successful exploitation of this vulnerability may CVE-2024-515195.5Vulnerability of input parameters not being verified in the HDC module Impact: Successful exploitation of this vulnerability may affect avaiCVE-2024-51525.4The ElementsReady Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘_id’ parameter in all versCVE-2024-515205.5Vulnerability of input parameters not being verified in the HDC module Impact: Successful exploitation of this vulnerability may affect avai
CVE-2024-5151: High severity, CVSS 7.1 | Vulnix