CVE-2024-5536

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

The GamiPress – Link plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's gamipress_link shortcode in all versions up to, and including, 1.1.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
rubengc	GamiPress – Link	<= 1.1.4

References

Timeline

Published: Jun 5, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-553719.8Wallos <= 2.38.2 has a file upload vulnerability in the restore backup function, which allows authenticated users to restore backups by uplo CVE-2024-553729.8Wallos <=2.38.2 has a file upload vulnerability in the restore database function, which allows unauthenticated users to restore database by CVE-2024-553745.3REDCap 14.3.13 allows an attacker to enumerate usernames due to an observable discrepancy between login attempts.CVE-2024-55399.2The Access Control Bypass vulnerability found in ALC WebCTRL and Carrier i-Vu in versions up to and including 8.5 allows a malicious actor t CVE-2024-553986.54C Strategies Exonaut before v22.4 was discovered to contain insecure permissions.CVE-2024-553996.54C Strategies Exonaut before v21.6.2.1-1 was discovered to contain a Server-Side Request Forgery (SSRF).CVE-2024-55406.9The reflective cross-site scripting vulnerability found in ALC WebCTRL and Carrier i-Vu in versions older than 8.0 affects login panels allo CVE-2024-554016.5An issue in 4C Strategies Exonaut before v22.4 allows attackers to execute a directory traversal.CVE-2024-554025.34C Strategies Exonaut before v22.4 was discovered to contain an access control issue.CVE-2024-554077.8An issue in the DeviceloControl function of ITE Tech. Inc ITE IO Access v1.0.0.0 allows attackers to perform arbitrary port read and write a CVE-2024-554085.3An improper access control vulnerability in the AsusSAIO.sys driver may lead to the misuse of software functionality utilizing the driver wh CVE-2024-55415.3The Ibtana – WordPress Website Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability c