CVE-2024-5199

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

The Spotify Play Button WordPress plugin through 1.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Jun 26, 2024
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2024

CVE-2024-519909.3jj, or Jujutsu, is a Git-compatible VCS written in rust. In affected versions specially crafted Git repositories can cause `jj` to write filCVE-2024-519914.9October is a Content Management System (CMS) and web platform. A vulnerability in versions prior to 3.7.5 affects authenticated administratoCVE-2024-519924.1Orchid is a @laravel package that allows for rapid application development of back-office applications, admin/user panels, and dashboards. TCVE-2024-519933.4Combodo iTop is a web based IT Service Management tool. An attacker accessing a backup file or the database can read some passwords for miscCVE-2024-519945.4Combodo iTop is a web based IT Service Management tool. In affected versions uploading a text file containing some java script in the portalCVE-2024-519957.1Combodo iTop is a web based IT Service Management tool. An attacker can request any `route` we want as long as we specify an `operation` thaCVE-2024-519967.5Symphony process is a module for the Symphony PHP framework which executes commands in sub-processes. When consuming a persisted remember-meCVE-2024-519978.1Trustee is a set of tools and components for attesting confidential guests and providing secrets to them. The ART (**Attestation Results TokCVE-2024-519988.6changedetection.io is a free open source web page change detection tool. The validation for the file URI scheme falls short, and results in CVE-2024-52004.8The Postie WordPress plugin before 1.9.71 does not sanitise and escape some of its settings, which could allow high privilege users such as CVE-2024-520006.1Combodo iTop is a simple, web based IT Service Management tool. Affected versions are subject to a reflected Cross-site Scripting (XSS) explCVE-2024-520014.3Combodo iTop is a simple, web based IT Service Management tool. In affected versions portal users are able to access forbidden services info
CVE-2024-5199: Medium severity, CVSS 5.4 | Vulnix