The Community by PeepSo – Social Network, Membership, Registration, User Profiles plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 6.4.5.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Metrics
Affected Vendors & Products
References
History
Thu, 19 Sep 2024 18:45:00 +0000
Type | Values Removed | Values Added |
---|---|---|
First Time appeared |
Peepso
Peepso peepso |
|
CPEs | cpe:2.3:a:peepso:peepso:*:*:*:*:*:wordpress:*:* | |
Vendors & Products |
Peepso
Peepso peepso |
Tue, 10 Sep 2024 14:30:00 +0000
Type | Values Removed | Values Added |
---|---|---|
Metrics |
ssvc
|
Tue, 10 Sep 2024 07:45:00 +0000
Type | Values Removed | Values Added |
---|---|---|
Description | The Community by PeepSo – Social Network, Membership, Registration, User Profiles plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 6.4.5.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. | |
Title | Community by PeepSo – Social Network, Membership, Registration, User Profiles <= 6.4.5.0 - Authenticated (Administrator+) Stored Cross-Site Scripting | |
Weaknesses | CWE-79 | |
References |
|
|
Metrics |
cvssV3_1
|
MITRE
Status: PUBLISHED
Assigner: Wordfence
Published: 2024-09-10T07:30:03.793Z
Updated: 2024-09-10T13:29:21.462Z
Reserved: 2024-08-09T18:41:44.413Z
Link: CVE-2024-7655
Vulnrichment
Updated: 2024-09-10T13:29:17.137Z
NVD
Status : Analyzed
Published: 2024-09-10T08:15:03.830
Modified: 2024-09-19T18:20:53.617
Link: CVE-2024-7655
Redhat
No data.