CVE-2024-9674

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

The Debrandify · Remove or Replace WordPress Branding plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.1.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Oct 18, 2024
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-96754.4A vulnerability was found in Buildah. Cache mounts do not properly validate that user-specified paths for the cache are within our cache dirCVE-2024-96766.5A vulnerability was found in Podman, Buildah, and CRI-O. A symlink traversal vulnerability in the containers/storage library can cause PodmaCVE-2024-96777.8The insufficiently protected credentials vulnerability in the CLI command of the USG FLEX H series uOS firmware version V1.21 and earlier veCVE-2024-96784.9An SQL Injection vulnerability existed in DLP Extension 11.11.1.3. The vulnerability allowed an attacker to perform arbitrary SQL queries pCVE-2024-96795.3A Hardcoded Cryptographic key vulnerability existed in DLP Extension 11.11.1.3 which allowed the decryption of previously encrypted user creCVE-2024-96809.8An attacker was able to achieve code execution in the content process by exploiting a use-after-free in Animation timelines. We have had repCVE-2024-96816.5When curl is asked to use HSTS, the expiry time for a subdomain might overwrite a parent domain's cache entry, making it end sooner or laterCVE-2024-96825.4The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Form Builder widCVE-2024-96835.3A vulnerability was found in Quay, which allows successful authentication even when a truncated password version is provided. This flaw affeCVE-2024-96847.5FreyrSCADA/IEC-60870-5-104 server v21.06.008 allows remote attackers to cause a denial of service by sending specific message sequences.CVE-2024-96854.3The Notification for Telegram plugin for WordPress is vulnerable to unauthorized test message sending due to a missing capability check on tCVE-2024-96865.3The Order Notification for Telegram plugin for WordPress is vulnerable to unauthorized test message sending due to a missing capability chec