CVE-2024-6688

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

The Oxygen Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the oxy_save_css_from_admin AJAX action in all versions up to, and including, 4.8.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update stylesheets.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published
Aug 27, 2024
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2024

CVE-2024-66897.8Local Privilege Escalation in MSI-Installer in baramundi Management Agent v23.1.172.0 on Windows allows a local unprivileged user to escalatCVE-2024-66906.1The wccp-pro WordPress plugin before 15.3 contains an open-redirect flaw via the referrer parameter, allowing redirection of users to externCVE-2024-66914.0The Easy Digital Downloads – Sell Digital Files & Subscriptions (eCommerce Store + Payments Made Easy) plugin for WordPress is vulnerable toCVE-2024-66923.1The Easy Digital Downloads – Sell Digital Files & Subscriptions (eCommerce Store + Payments Made Easy) plugin for WordPress is vulnerable toCVE-2024-66934.8The wccp-pro WordPress plugin before 15.3 does not sanitise and escape some of its settings, which could allow high privilege users such as CVE-2024-66942.7The WP Mail SMTP plugin for WordPress is vulnerable to information exposure in all versions up to, and including, 4.0.1. This is due to plugCVE-2024-66959.8it's possible for an attacker to gain administrative access without having any kind of account on the targeted site and perform unauthorizedCVE-2024-66964.9The product implements access controls via a policy or other feature with the intention to disable or restrict accesses (reads and/or writesCVE-2024-66976.5The product does not handle or incorrectly handles when it has insufficient privileges to access resources or functionality as specified by CVE-2024-66988.8The FundEngine plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.7.0. This is due to the plCVE-2024-66999.8Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Mikafon Electronic Inc. Mikafon MA7 alCVE-2024-67004.8Pega Platform versions 8.1 to Infinity 24.1.2 are affected by an XSS issue with App name.