CVE-2024-5647: Multiple plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled Magnific Popups library (version 1.1.0) in various…

PriorityP430medium6.4CVSS 3.1

AVNACLPRLUINSCCLILAN

EPSS

0.29%

20.8th percentile

Multiple plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled Magnific Popups library (version 1.1.0) in various versions due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. NOTE: This vulnerability was fixed in the upstream library (Magnific Popups version 1.2.0) by disabling the loading of HTML within certain fields by default.

Affected

12 ranges

Vendor	Product	Version range	Fixed in
blossomthemes	blossomthemes_social_feed	<= 2.0.5	—
boldthemes	bold_page_builder	<= 5.1.2	—
elegant_themes	divi	<= 4.27.1	—
elegant_themes	divi_builder	<= 4.27.1	—
elegant_themes	divi_extra	<= 4.27.1	—
gn_themes	wp_shortcodes_plugin_shortcodes_ultimate	<= 7.4.2	—
gutentor	gutentor_gutenberg_blocks_page_builder_for_gutenberg_editor	<= 3.4.9	—
oceanwp	oceanwp	<= 3.6.0	—
robosoft	robo_gallery_photo_image_slider	<= 3.2.22	—
sayful	carousel_slider	<= 2.2.14	—
thehappymonster	happy_addons_for_elementor	<= 3.12.2	—
wpdevteam	essential_addons_for_elementor_popular_elementor_templates_widgets	<= 6.0.4	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.