PoC Index

CVE-2024-2640

MEDIUM 6.8EPSS 0.4%

The Watu Quiz WordPress plugin before 3.4.1.2 does not sanitise and escape some of its settings, which could allow users such as authors (if they've been authorized by admins) to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.

CVSS v3.1
5.4 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVSS v3.1
6.8 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:L
EPSS
0.39% chance of exploitation in the next 30 days, 33th percentile
Published
2024-07-12
Updated
2024-08-01

Proof-of-concept exploits (1)

References

Related