The Envo Extra plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple parameters in versions up to, and including, 1.8.16 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Metrics
Affected Vendors & Products
References
History
Thu, 30 Jan 2025 16:30:00 +0000
Type | Values Removed | Values Added |
---|---|---|
First Time appeared |
Envothemes
Envothemes envo Extra |
|
Weaknesses | CWE-79 | |
CPEs | cpe:2.3:a:envothemes:envo_extra:*:*:*:*:*:wordpress:*:* | |
Vendors & Products |
Envothemes
Envothemes envo Extra |

Status: PUBLISHED
Assigner: Wordfence
Published: 2024-05-16T11:05:28.188Z
Updated: 2024-08-01T20:40:47.207Z
Reserved: 2024-05-01T00:32:28.271Z
Link: CVE-2024-4385

Updated: 2024-08-01T20:40:47.207Z

Status : Analyzed
Published: 2024-05-16T11:15:48.577
Modified: 2025-01-30T16:09:33.727
Link: CVE-2024-4385

No data.