CVE-2024-2869: Easy Property Listings <= 3.5.3 - Admin+ Stored XSS
The Easy Property Listings WordPress plugin before 3.5.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed (for example in multisite setup)
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-2869?
CVE-2024-2869 has a moderate severity level due to its potential for Stored Cross-Site Scripting attacks.
How do I fix CVE-2024-2869?
To fix CVE-2024-2869, update the Easy Property Listings plugin to version 3.5.4 or later.
Who is affected by CVE-2024-2869?
CVE-2024-2869 affects users of the Easy Property Listings WordPress plugin prior to version 3.5.4.
What type of attack does CVE-2024-2869 enable?
CVE-2024-2869 enables high privilege users to perform Stored Cross-Site Scripting (XSS) attacks.
What versions of Easy Property Listings are vulnerable to CVE-2024-2869?
All versions of Easy Property Listings prior to 3.5.4 are vulnerable to CVE-2024-2869.