CVE-2024-2837

The WP Chat App WordPress plugin before 3.6.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admins to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed

CVSS v3.1

5.4 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

EPSS

0.52% chance of exploitation in the next 30 days, 42th percentile

Published

2024-04-26

Updated

2024-08-01

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/91058c48-f262-4fcc-9390-472d59d61115/

References

• CVE Record
• NVD entry

Related

• CVE-2024-2836
• CVE-2024-28383
• CVE-2024-28345
• CVE-2024-28397
• CVE-2024-28344
• CVE-2024-28417