CVE-2024-6692

LowCVSS 3.1/10Last modified Jun 17, 2026

Description

The Easy Digital Downloads – Sell Digital Files & Subscriptions (eCommerce Store + Payments Made Easy) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Agreement Text value in all versions up to, and including, 3.3.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

Metrics

CVSS 3.1 3.1/10CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Aug 12, 2024
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-66934.8The wccp-pro WordPress plugin before 15.3 does not sanitise and escape some of its settings, which could allow high privilege users such as CVE-2024-66942.7The WP Mail SMTP plugin for WordPress is vulnerable to information exposure in all versions up to, and including, 4.0.1. This is due to plugCVE-2024-66959.8it's possible for an attacker to gain administrative access without having any kind of account on the targeted site and perform unauthorizedCVE-2024-66964.9The product implements access controls via a policy or other feature with the intention to disable or restrict accesses (reads and/or writesCVE-2024-66976.5The product does not handle or incorrectly handles when it has insufficient privileges to access resources or functionality as specified by CVE-2024-66988.8The FundEngine plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.7.0. This is due to the plCVE-2024-66999.8Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Mikafon Electronic Inc. Mikafon MA7 alCVE-2024-67004.8Pega Platform versions 8.1 to Infinity 24.1.2 are affected by an XSS issue with App name.CVE-2024-67014.8Pega Platform versions 8.1 to Infinity 24.1.2 are affected by an XSS issue with case type.CVE-2024-67024.8Pega Platform versions 8.1 to Infinity 24.1.2 are affected by an HTML Injection issue with Stage.CVE-2024-67035.4The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to Stored CrossCVE-2024-67046.1The Comments – wpDiscuz plugin for WordPress is vulnerable to HTML Injection in all versions up to, and including, 7.6.21. This is due to a