CVE-2024-3111: H5P < 1.15.8 - Contributor+ Stored XSS
Published Jun 27, 2024
·Updated
The Interactive Content WordPress plugin before 1.15.8 does not validate uploads which could allow a Contributors and above to update malicious SVG files, leading to Stored Cross-Site Scripting issues
Affected Software
1 affected component
H5P H5p Wordpress<1.15.8
Event History
Jun 27, 2024
CVE Published
via MITRE·06:00 AM
Data Sourced
via MITRE·06:00 AM
DescriptionWeakness
Data Sourced
via NVD·06:15 AM
DescriptionSeverityWeaknessAffected Software
Aug 5, 56554
Event
via NVD·12:20 PM
Frequently Asked Questions
1
What is the severity of CVE-2024-3111?
CVE-2024-3111 has been rated with a medium severity due to its potential for stored cross-site scripting vulnerabilities.
2
How do I fix CVE-2024-3111?
To fix CVE-2024-3111, update the Interactive Content WordPress plugin to version 1.15.8 or later.
3
Who is affected by CVE-2024-3111?
CVE-2024-3111 affects users of the Interactive Content WordPress plugin versions prior to 1.15.8.
4
What could attackers do with CVE-2024-3111?
Attackers could exploit CVE-2024-3111 by uploading malicious SVG files, leading to stored cross-site scripting attacks.
5
What versions of the Interactive Content plugin are vulnerable to CVE-2024-3111?
Versions of the Interactive Content WordPress plugin before 1.15.8 are vulnerable to CVE-2024-3111.