CVE-2024-2404

Better Comments < 1.5.6 - Subscriber+ Stored XSS

The Better Comments WordPress plugin before 1.5.6 does not sanitise and escape some of its settings, which could allow low privilege users such as Subscribers to perform Stored Cross-Site Scripting attacks.

Affected

Better Comments

CVSS v3.1 NVD

5.4 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS

0.40% chance of exploitation in the next 30 days, 33rd percentile

Published

2024-04-24

Updated

2024-08-09

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/a2cb7167-9edc-4640-87eb-4c511639e5b7/

Security advisories

• https://wpscan.com/vulnerability/a2cb7167-9edc-4640-87eb-4c511639e5b7

References

• CVE Record
• NVD entry