CVE-2024-7302

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 3gp2 file uploads in all versions up to, and including, 7.5.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the 3gp2 file.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Aug 1, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-73035.4A vulnerability was found in itsourcecode Online Blood Bank Management System 1.0. It has been rated as problematic. This issue affects some CVE-2024-73045.4The Ninja Tables – Easiest Data Table Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all CVE-2024-73057.8A maliciously crafted DWF file, when parsed in AdDwfPdk.dll through Autodesk AutoCAD, may force an Out-of-Bounds Write vulnerability. A mali CVE-2024-73068.8A vulnerability, which was classified as critical, was found in SourceCodester Establishment Billing Management System 1.0. Affected is an u CVE-2024-73078.8A vulnerability has been found in SourceCodester Establishment Billing Management System 1.0 and classified as critical. Affected by this vu CVE-2024-73088.8A vulnerability was found in SourceCodester Establishment Billing Management System 1.0 and classified as critical. Affected by this issue i CVE-2024-73095.4A vulnerability was found in SourceCodester Record Management System 1.0. It has been classified as problematic. This affects an unknown par CVE-2024-73106.1A vulnerability was found in SourceCodester Record Management System 1.0. It has been declared as problematic. This vulnerability affects un CVE-2024-73119.8A vulnerability was found in code-projects Online Bus Reservation Site 1.0. It has been rated as critical. This issue affects some unknown p CVE-2024-73126.1URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Payara Platform Payara Server (REST Management Interface modules) allow CVE-2024-73136.1The Shield Security WordPress plugin before 20.0.6 does not sanitise and escape a parameter before outputting it back in the page, leading CVE-2024-73149.8anji-plus AJ-Report is affected by an authentication bypass vulnerability. A remote and unauthenticated attacker can append ";swagger-ui" to