CVE-2024-5155

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

The Inquiry cart WordPress plugin through 3.4.2 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-352

Affected software

VendorProductVersions
UnknownInquiry cart<= 3.4.2
ravi_desaiinquiry_cart<= 3.4.2

References

Timeline

Published
Jun 14, 2024
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-515509.8Data Validation / Data Sanitization vulnerabilities in Linux allows unvalidated and unsanitized data to be injected in an Aspect device.  ACVE-2024-5155110.0Default Credentail vulnerabilities in ASPECT on Linux allows access to the product using publicly available default credentials.  Affected pCVE-2024-515526.0Weak password storage vulnerabilities exist in ASPECT if administrator credentials become compromisedThis issue affects ASPECT-Enterprise: tCVE-2024-515536.5Predictable filename vulnerabilities in ASPECT may expose sensitive information to a potential attacker if administrator credentials become CVE-2024-515549.8Default Credentail vulnerabilities in ASPECT on Linux allows access to the product using publicly available default credentials.  Affected pCVE-2024-5155510.0Default Credentail vulnerabilities allows access to an Aspect device using publicly available default credentials since the system does not CVE-2024-515566.5This vulnerability exists in the Wave 2.0 due to insufficient encryption of sensitive data received at the API response. An authenticated reCVE-2024-515576.5This vulnerability exists in the Wave 2.0 due to missing rate limiting on OTP requests in an API endpoint. An authenticated remote attacker CVE-2024-515589.8This vulnerability exists in the Wave 2.0 due to missing restrictions for excessive failed authentication attempts on its API based login. ACVE-2024-515596.5This vulnerability exists in the Wave 2.0 due to improper authorization checks on certain API endpoints. An authenticated remote attacker coCVE-2024-51566.4The Flatsome theme for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and incluCVE-2024-515604.3This vulnerability exists in the Wave 2.0 due to improper exception handling for invalid inputs at certain API endpoint. An authenticated re
CVE-2024-5155: Medium severity, CVSS 6.1 | Vulnix