CVE-2024-5251

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

The Ultimate Addons for WPBakery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's ultimate_pricing shortcode in all versions up to, and including, 3.19.20 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Jul 17, 2024
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2024

CVE-2024-525107.5The Nextcloud Desktop Client is a tool to synchronize files from Nextcloud Server with your computer. The Desktop client did not stop with aCVE-2024-525116.5Nextcloud Tables allows users to to create tables with individual columns. By directly specifying the ID of a table or view, a malicious useCVE-2024-525126.1user_oidc app is an OpenID Connect user backend for Nextcloud. A malicious user could send a malformed login link that would redirect the usCVE-2024-525134.3Nextcloud Server is a self hosted personal cloud system. After receiving a "Files drop" or "Password protected" share link a malicious user CVE-2024-525143.5Nextcloud Server is a self hosted personal cloud system. After a user received a share with some files inside being blocked by the files accCVE-2024-525156.5Nextcloud Server is a self hosted personal cloud system. After an admin enables the default-disabled SVG preview provider, a malicious user CVE-2024-525164.3Nextcloud Server is a self hosted personal cloud system. When a server is configured to only allow sharing with users that are in ones own gCVE-2024-525175.9Nextcloud Server is a self hosted personal cloud system. After storing "Global credentials" on the server, the API returns them and adds theCVE-2024-525185.4Nextcloud Server is a self hosted personal cloud system. After an attacker got access to the session of a user or administrator, the attackeCVE-2024-525198.2Nextcloud Server is a self hosted personal cloud system. The OAuth2 client secrets were stored in a recoverable way, so that an attacker thaCVE-2024-52525.4The Ultimate Addons for WPBakery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's ultimate_info_table shorCVE-2024-525206.5Nextcloud Server is a self hosted personal cloud system. Due to a pre-flighted HEAD request, the link reference provider could be tricked in
CVE-2024-5251: Medium severity, CVSS 5.4 | Vulnix