CVE-2024-2640

CWE-79 — Cross-site Scripting (XSS)4 documents4 sources
Severity
5.4MEDIUM
EPSS
0.4%
top 40.70%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Unknown Watu QuizKibokolabs Watu Quiz
Timeline
PublishedJul 12
Latest updateDec 27

Description

The Watu Quiz WordPress plugin before 3.4.1.2 does not sanitise and escape some of its settings, which could allow users such as authors (if they've been authorized by admins) to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NExploitability: 2.3 | Impact: 2.7

Affected Packages2 packages

▶CVEListV5unknown/watu_quiz< 3.4.1.2
▶NVDkibokolabs/watu_quiz< 3.4.1.2

🔴Vulnerability Details

2
GHSA
GHSA-c7x7-vc85-8vmc: The Watu Quiz WordPress plugin before 3↗2024-07-12
▶
CVEList
Watu Quiz < 3.4.1.2 - Author+ Stored XSS↗2024-07-12
▶

📋Vendor Advisories

1
Red Hat
kernel: drm/xe/guc_submit: fix race around suspend_pending↗2024-12-27
▶
CVE-2024-2640 (MEDIUM CVSS 5.4) | The Watu Quiz WordPress plugin befo | cvebase.io