CVE-2024-2640

Description

The Watu Quiz WordPress plugin before 3.4.1.2 does not sanitise and escape some of its settings, which could allow users such as authors (if they've been authorized by admins) to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.

Problem types

CWE-79 Cross-Site Scripting (XSS)

Product status

Credits

Eunho Kim 0x400701fde0

WPScan 0x400701fdf0

References

https://wpscan.com/vulnerability/d46db635-9d84-4268-a789-406a0db4cccf/ exploit vdb-entry technical-description

cve.org CVE-2024-2640

nvd.nist.gov CVE-2024-2640

Download JSON