CVE-2024-6693

MediumCVSS 4.8/10Last modified Jun 17, 2026

Description

The wccp-pro WordPress plugin before 15.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: May 15, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-66942.7The WP Mail SMTP plugin for WordPress is vulnerable to information exposure in all versions up to, and including, 4.0.1. This is due to plug CVE-2024-66959.8it's possible for an attacker to gain administrative access without having any kind of account on the targeted site and perform unauthorized CVE-2024-66964.9The product implements access controls via a policy or other feature with the intention to disable or restrict accesses (reads and/or writes CVE-2024-66976.5The product does not handle or incorrectly handles when it has insufficient privileges to access resources or functionality as specified by CVE-2024-66988.8The FundEngine plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.7.0. This is due to the pl CVE-2024-66999.8Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Mikafon Electronic Inc. Mikafon MA7 al CVE-2024-67004.8Pega Platform versions 8.1 to Infinity 24.1.2 are affected by an XSS issue with App name.CVE-2024-67014.8Pega Platform versions 8.1 to Infinity 24.1.2 are affected by an XSS issue with case type.CVE-2024-67024.8Pega Platform versions 8.1 to Infinity 24.1.2 are affected by an HTML Injection issue with Stage.CVE-2024-67035.4The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to Stored Cross CVE-2024-67046.1The Comments – wpDiscuz plugin for WordPress is vulnerable to HTML Injection in all versions up to, and including, 7.6.21. This is due to a CVE-2024-67055.5The RegLevel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.2.