CVE-2024-5002: User Submitted Posts < 20240516 - Admin+ Stored XSS
The User Submitted Posts WordPress plugin before 20240516 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed (for example in multisite setup)
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-5002?
CVE-2024-5002 is rated as a medium severity vulnerability due to its potential for stored Cross-Site Scripting attacks.
How do I fix CVE-2024-5002?
To fix CVE-2024-5002, update the User Submitted Posts WordPress plugin to the version released on or after 20240516.
Who is affected by CVE-2024-5002?
The CVE-2024-5002 vulnerability affects websites using the User Submitted Posts plugin for WordPress versions prior to 20240516.
What type of attack does CVE-2024-5002 enable?
CVE-2024-5002 enables high privilege users to perform Stored Cross-Site Scripting (XSS) attacks due to insufficient sanitization and escaping.
Can CVE-2024-5002 be exploited by regular users?
No, CVE-2024-5002 can primarily be exploited by high privilege users, such as administrators.