CVSS 3.1
5.4 mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NCVE-2024-1357
Medium (5.4) in averta shortcodes and extra features for phlox theme. EPSS 0.4% chance of exploitation in the next 30 days.
The Shortcodes and extra features for Phlox theme plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's aux_timeline shortcode in all versions up to, and including, 2.15.7 due to insufficient input sanitization and output escaping on user supplied attributes such as thumb_mode and date_type. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Severity
- EPSS
- 0.4% chance of exploitation in the next 30 days; higher than 34% of CVEs (scores of 2026-10-31)
- CWE
- CWE-79
- Published
- Modified
- Record from
- the NVD, synced
Affected
- averta:shortcodes_and_extra_features_for_phlox_theme
References
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3074455%40auxin-elements&new=3074455%40auxin-elements&sfp_email=&sfph_mail=#file8
- https://www.wordfence.com/threat-intel/vulnerabilities/id/fe175315-99ef-438a-b5b0-a5f190403116?source=cve
- https://plugins.trac.wordpress.org/browser/auxin-elements/trunk/includes/general-shortcodes.php#L310
- https://www.wordfence.com/threat-intel/vulnerabilities/id/fe175315-99ef-438a-b5b0-a5f190403116?source=cve