CVE-2024-54439

HighCVSS 7.1/10Last modified Jun 17, 2026

Description

Cross-Site Request Forgery (CSRF) vulnerability in Alok Tiwari Amazon Product Price amazon-product-price allows Stored XSS.This issue affects Amazon Product Price: from n/a through <= 1.1.

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Weakness enumeration

CWE-352

Affected software

No affected versions have been published.

Timeline

Published: Dec 16, 2024
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-54445.4The Bible Text WordPress plugin through 0.2 does not validate and escape some of its shortcode attributes before outputting them back in a p CVE-2024-544407.1Cross-Site Request Forgery (CSRF) vulnerability in blueskyy WP-Ban-User wp-ban-user allows Stored XSS.This issue affects WP-Ban-User: from n CVE-2024-544416.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Meini Utech World Time utech-world-tim CVE-2024-544425.9Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in cortesfrau Better WP Login Page better CVE-2024-544436.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PluginsCafe Advanced Data Table For El CVE-2024-544445.4Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Elementor Elementor Website Builder el CVE-2024-544458.7Login functionality contains a blind SQL injection that can be exploited by unauthenticated attackers. Using a time-based blind SQLi techniq CVE-2024-544467.1Document history functionality contains a blind SQL injection that can be exploited by authenticated attackers. Using a time-based blind SQL CVE-2024-544477.1Saved search functionality contains a blind SQL injection that can be exploited by authenticated attackers. Using a time-based blind SQLi te CVE-2024-544487.2The Automation Scripting functionality can be exploited by attackers to run arbitrary system commands on the underlying operating system. An CVE-2024-544498.8The API used to interact with documents in the application contains two endpoints with a flaw that allows an authenticated attacker to write CVE-2024-54453.8Ecosystem Agent version 4 < 4.1.5.2597 and Ecosystem Agent version 5 < 5.1.4.2473 did not properly validate SSL/TLS certificates, which coul