CVE-2024-5457

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

The Panda Video plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ parameter in all versions up to, and including, 1.4.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Jul 9, 2024
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2024

CVE-2024-54585.3In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, due to a code logic error, filtering functions such as filter_CVE-2024-54594.3The Restaurant Menu and Food Ordering plugin for WordPress is vulnerable to unauthorized creation of data due to a missing capability check CVE-2024-54608.1A vulnerability in the default configuration of the Simple Network Management Protocol (SNMP) feature of Brocade Fabric OS versions before CVE-2024-54618.0Implementation of the Simple Network Management Protocol (SNMP) operating on the Brocade 6547 (FC5022) embedded switch blade, makes internCVE-2024-54627.5If Brocade Fabric OS before Fabric OS 9.2.0 configuration settings are not set to encrypt SNMP passwords, then the SNMP privsecret / authsecCVE-2024-54636.5A vulnerability regarding buffer copy without checking the size of input ('Classic Buffer Overflow') has been found in the login component. CVE-2024-54643.3Vulnerability of insufficient permission verification in the NearLink module Impact: Successful exploitation of this vulnerability may affecCVE-2024-54655.5Function vulnerabilities in the Calendar module Impact: Successful exploitation of this vulnerability will affect availability.CVE-2024-546586.5The issue was addressed with improved memory handling. This issue is fixed in Safari 17.4, iOS 17.4 and iPadOS 17.4, macOS Sonoma 14.4, tvOSCVE-2024-54668.8Zohocorp ManageEngine OpManager and Remote Monitoring and Management versions 128329 and below are vulnerable to the authenticated remote coCVE-2024-546608.7A JNDI injection issue was discovered in Cloudera JDBC Connector for Hive before 2.6.26 and JDBC Connector for Impala before 2.6.35. AttackeCVE-2024-546619.8readline.sh in socat before1.8.0.2 relies on the /tmp/$USER/stderr2 file.