The Envo Extra plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple parameters in versions up to, and including, 1.8.16 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
History

Thu, 30 Jan 2025 16:30:00 +0000

Type Values Removed Values Added
First Time appeared Envothemes
Envothemes envo Extra
Weaknesses CWE-79
CPEs cpe:2.3:a:envothemes:envo_extra:*:*:*:*:*:wordpress:*:*
Vendors & Products Envothemes
Envothemes envo Extra

cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published: 2024-05-16T11:05:28.188Z

Updated: 2024-08-01T20:40:47.207Z

Reserved: 2024-05-01T00:32:28.271Z

Link: CVE-2024-4385

cve-icon Vulnrichment

Updated: 2024-08-01T20:40:47.207Z

cve-icon NVD

Status : Analyzed

Published: 2024-05-16T11:15:48.577

Modified: 2025-01-30T16:09:33.727

Link: CVE-2024-4385

cve-icon Redhat

No data.