CVE-2024-9578

5.3 mediumEPSS 0.5%

Medium (5.3) in avovkdesign hide links. EPSS 0.5% chance of exploitation in the next 30 days.

The Hide Links plugin for WordPress is vulnerable to unauthorized shortcode execution due to do_shortcode being hooked through the comment_text filter in all versions up to and including 1.4.2. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes available on the target site.

Severity

CVSS 3.1

5.3 medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS: 0.5% chance of exploitation in the next 30 days; higher than 46% of CVEs (scores of 2026-10-31)
CWE: CWE-862
Published: 2024-11-13
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

avovkdesign:hide_links

References

https://plugins.trac.wordpress.org/browser/hide-links/trunk/class.hidelinks.php#L21
https://www.wordfence.com/threat-intel/vulnerabilities/id/4198bbb2-3aff-492e-a781-b0c9477baf6c?source=cve

Check your stack JSON