CVE-2024-3586: LetterPress < 2.4.0 - Admin+ Stored XSS
The LetterPress WordPress plugin before 2.4.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed (for example in multisite setup)
Affected Software
Event History
Frequently Asked Questions
Which deployments are most relevant to this issue?
Deployments using the LetterPress plugin before version 2.4.0 are affected. The issue is specifically relevant where high-privilege users, such as administrators, can modify plugin settings, including multisite environments where the unfiltered_html capability is disabled.
What level of access is required to exploit the vulnerability?
An attacker needs high-privilege access, such as administrator access, to configure vulnerable LetterPress settings. The flaw allows stored script injection through settings that are not sanitised or escaped.
Does disabling the unfiltered_html capability prevent exploitation?
No. The issue can be exploited by high-privilege users even when unfiltered_html is disallowed, such as in a multisite setup.