The WP Last Modified Info plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘template’ attribute of the lmt-post-modified-info shortcode in all versions up to, and including, 1.9.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Metrics
Affected Vendors & Products
References
History
Tue, 03 Sep 2024 20:45:00 +0000
Type | Values Removed | Values Added |
---|---|---|
First Time appeared |
Sayandatta
Sayandatta wp Last Modified Info |
|
CPEs | cpe:2.3:a:sayandatta:wp_last_modified_info:*:*:*:*:*:wordpress:*:* | |
Vendors & Products |
Sayandatta
Sayandatta wp Last Modified Info |
Thu, 29 Aug 2024 20:30:00 +0000
Type | Values Removed | Values Added |
---|---|---|
Metrics |
ssvc
|
Tue, 20 Aug 2024 04:45:00 +0000
Type | Values Removed | Values Added |
---|---|---|
Description | The WP Last Modified Info plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘template’ attribute of the lmt-post-modified-info shortcode in all versions up to, and including, 1.9.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | |
Title | WP Last Modified Info <= 1.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via lmt-post-modified-info Shortcode | |
Weaknesses | CWE-79 | |
References |
|
|
Metrics |
cvssV3_1
|
MITRE
Status: PUBLISHED
Assigner: Wordfence
Published: 2024-08-20T04:28:33.896Z
Updated: 2024-09-13T11:30:31.393Z
Reserved: 2024-07-17T20:45:42.771Z
Link: CVE-2024-6864
Vulnrichment
Updated: 2024-08-29T17:22:58.309Z
NVD
Status : Analyzed
Published: 2024-08-20T05:15:12.137
Modified: 2024-09-03T20:22:16.433
Link: CVE-2024-6864
Redhat
No data.