CVE-2024-6487: Inline Related Posts < 3.8.0 - Admin+ Stored XSS
The Inline Related Posts WordPress plugin before 3.8.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed (for example in multisite setup)
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-6487?
CVE-2024-6487 has been determined to have a high severity rating due to its potential for stored Cross-Site Scripting attacks.
How do I fix CVE-2024-6487?
To fix CVE-2024-6487, update the Inline Related Posts WordPress plugin to version 3.8.0 or later.
Who is affected by CVE-2024-6487?
CVE-2024-6487 affects users of the Inline Related Posts WordPress plugin versions prior to 3.8.0.
What type of attack does CVE-2024-6487 facilitate?
CVE-2024-6487 facilitates Stored Cross-Site Scripting attacks due to insufficient sanitization and escaping of plugin settings.
Can lower privilege users exploit CVE-2024-6487?
No, only high privilege users such as administrators can exploit CVE-2024-6487 for attacks.