CVE-2024-5177

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

The Hash Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'url' parameter within multiple widgets in all versions up to, and including, 1.3.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
hashthemes	Hash Elements	<= 1.3.8

References

Timeline

Published: May 23, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-517707.5An information disclosure vulnerability exists in HPE AutoPass License Server (APLS) prior to 9.17.CVE-2024-517718.8A vulnerability in the HPE Aruba Networking ClearPass Policy Manager web-based management interface could allow an authenticated remote thre CVE-2024-517728.0An authenticated RCE vulnerability in the ClearPass Policy Manager web-based management interface allows remote authenticated users to run a CVE-2024-517735.4A vulnerability in the HPE Aruba Networking ClearPass Policy Manager web-based management interface could allow an authenticated remote Atta CVE-2024-517748.1qBittorrent before 5.0.1 proceeds with use of https URLs even after certificate validation errors.CVE-2024-517755.3Missing Origin Validation in WebSockets vulnerability in Apache Zeppelin. The attacker could access the Zeppelin server from another origin CVE-2024-517767.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sam Hotchkiss Daily Image daily-image CVE-2024-517787.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tevya Satisfaction Reports from Help S CVE-2024-517797.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jason Coleman Don't Break The Code don CVE-2024-51784.9ServiceNow has addressed a sensitive file read vulnerability that was identified in the Washington DC, Vancouver, and Utah Now Platform rele CVE-2024-517807.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in eewee eewee admin custom eewee-admincu CVE-2024-517817.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Stefan Backor Firework Shoppable Live