CVE-2024-3586
CVE-2024-3586 · LetterPress < 2.4.0 - Admin+ Stored XSS
This page contains facts from public vulnerability sources. Check the original advisory before updating.
The LetterPress WordPress plugin before 2.4.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVSS 3.5 · Low · EPSS 0.2% · Fix available
- Published
- Updated
Affected products and versions
letterpress
- Versions
- ≥ 0, < 2.4.0: Affected (semver)
Update to 2.4.0