CVE-2024-6334 | THREATINT

Assigner	WPScan
Reserved	2024-06-25
Published	2024-07-09
Updated	2024-08-01

Description

The Easy Table of Contents WordPress plugin before 2.0.67.1 does not sanitise and escape some of its settings, which could allow high privilege users such as editors to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed.

Problem types

CWE-79 Cross-Site Scripting (XSS)

Product status

Default status

unaffected

Any version before 2.0.67.1

affected

Credits

Dmitrii Ignatyev 0x4002e3cd10

WPScan 0x4002e3cd20

References

https://wpscan.com/vulnerability/6c09083c-6960-4369-8c5c-ad20e34aaa8b/ exploit vdb-entry technical-description

cve.org CVE-2024-6334

nvd.nist.gov CVE-2024-6334

Download JSON

https://cve.threatint.com

Subscribe to our newsletter to learn more about our work.