CVE-2024-6797

MediumCVSS 4.8/10Last modified Jun 17, 2026

Description

The DL Robots.txt WordPress plugin through 1.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
May 15, 2025
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-67984.8The DL Verification WordPress plugin through 1.2 does not sanitise and escape some of its settings, which could allow high privilege users sCVE-2024-67994.3The YITH Essential Kit for WooCommerce #1 plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capabilitCVE-2024-68009.8An XML signature wrapping vulnerability was present in GitHub Enterprise Server (GHES) when using SAML authentication with specific identityCVE-2024-68019.8A vulnerability, which was classified as critical, has been found in SourceCodester Online Student Management System 1.0. This issue affectsCVE-2024-68029.8A vulnerability, which was classified as critical, was found in SourceCodester Computer Laboratory Management System 1.0. Affected is an unkCVE-2024-68039.8A vulnerability has been found in itsourcecode Document Management System 1.0 and classified as critical. Affected by this vulnerability is CVE-2024-68045.4The Jeg Elementor Kit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and inclCVE-2024-68059.8The NI VeriStand Gateway is missing authorization checks when an actor attempts to access File Transfer resources. These missing checks mayCVE-2024-68069.8The NI VeriStand Gateway is missing authorization checks when an actor attempts to access Project resources. These missing checks may resulCVE-2024-68073.4A vulnerability was found in SourceCodester Student Study Center Desk Management System 1.0 and classified as problematic. Affected by this CVE-2024-68089.8A vulnerability was found in itsourcecode Simple Task List 1.0. It has been classified as critical. This affects the function insertUserRecoCVE-2024-68099.8The Simple Video Directory WordPress plugin before 1.4.3 does not properly sanitise and escape a parameter before using it in a SQL statemen