CVE-2024-7878

MediumCVSS 4.8/10Last modified Jun 17, 2026

Description

The WP ULike WordPress plugin before 4.7.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Unknown	WP ULike	< 4.7.4
wpulike	wp_ulike	< 4.7.4

References

https://wpscan.com/vulnerability/9166cf91-69e5-4786-a6a9-816db7d47b07/Exploit, Third Party Advisory

Timeline

Published: Sep 25, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-78794.8The WP ULike WordPress plugin before 4.7.5 does not sanitise and escape some of its settings, which could allow high privilege users such a CVE-2024-78815.1An unprivileged context can trigger a data memory-dependent prefetch engine to fetch the contents of a privileged location and consume those CVE-2024-78826.5Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Special Minds Design and Software e-Co CVE-2024-78833.7When using Arm Cortex-M Security Extensions (CMSE), Secure stack contents can be leaked to Non-secure state via floating-point registers w CVE-2024-78847.5When a canister method is called via ic_cdk::call* , a new Future CallFuture is created and can be awaited by the caller to get the executi CVE-2024-78857.5A vulnerability was found in Undertow where the ProxyProtocolReadListener reuses the same StringBuilder instance across multiple requests. T CVE-2024-78867.8A vulnerability has been found in Scooter Software Beyond Compare up to 3.3.5.15075 and classified as critical. Affected by this vulnerabili CVE-2024-78874.9A vulnerability was found in LimeSurvey 6.3.0-231016 and classified as problematic. Affected by this issue is some unknown functionality of CVE-2024-78884.3The Classified Listing – Classified ads & Business Directory Plugin plugin for WordPress is vulnerable to unauthorized access due to a missi CVE-2024-78897.3Local privilege escalation allows a low-privileged user to gain SYSTEM privileges in Citrix Workspace app for Windows CVE-2024-78907.3Local privilege escalation allows a low-privileged user to gain SYSTEM privileges in Citrix Workspace app for Windows CVE-2024-78914.8The Floating Contact Button WordPress plugin before 2.8 does not sanitise and escape some of its settings, which could allow high privilege