CVE-2024-5172

MediumCVSS 4.8/10Last modified Jun 17, 2026

Description

The Expert Invoice WordPress plugin through 1.0.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Unknown	Expert Invoice	<= 1.0.2
expert_invoice	export_invoice	<= 1.0.2

References

https://wpscan.com/vulnerability/65d84e69-0548-4c7d-bcde-5777d72da555/Exploit, Third Party Advisory
https://wpscan.com/vulnerability/65d84e69-0548-4c7d-bcde-5777d72da555/Exploit, Third Party Advisory

Timeline

Published: Jun 18, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-517204.8An insufficient entropy vulnerability in the SecuSUITE Secure Client Authentication (SCA) Server of SecuSUITE versions 5.0.420 and earlier c CVE-2024-517217.3A code injection vulnerability in the SecuSUITE Server Web Administration Portal of SecuSUITE versions 5.0.420 and earlier could allow an at CVE-2024-517226.4A local privilege escalation vulnerability in the SecuSUITE Server (System Configuration) of SecuSUITE versions 5.0.420 and earlier could al CVE-2024-517234.6A Stored Cross-Site Scripting (XSS) vulnerability in the Management Console of BlackBerry AtHoc version 7.15 could allow an attacker to pote CVE-2024-517277.5Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x contains a feature that could enable attackers to invalidate a legitimate u CVE-2024-517297.8In the Linux kernel, the following vulnerability has been resolved: mm: use aligned address in copy_user_gigantic_page() In current kernel CVE-2024-51735.4The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Video player widget se CVE-2024-517348.7Zope AccessControl provides a general security framework for use in Zope. In affected versions anonymous users can delete the user data main CVE-2024-517358.7Osmedeus is a Workflow Engine for Offensive Security. Cross-site Scripting (XSS) occurs on the Osmedues web server when viewing results from CVE-2024-517369.8Symphony process is a module for the Symphony PHP framework which executes commands in sub-processes. On Windows, when an executable file na CVE-2024-517377.0RediSearch is a Redis module that provides querying, secondary indexing, and full-text search for Redis. An authenticated redis user executi CVE-2024-517388.1Sunshine is a self-hosted game stream host for Moonlight. In 0.23.1 and earlier, Sunshine's pairing protocol implementation does not validat