CVE Database /
CVE-2024-32456
CVE · Medium
CVE-2024-32456 — Envo Extra [envo-extra] < 1.8.12
| CVE |
Vulnerability |
Type |
Severity |
Affected |
Fixed in |
Published |
Status |
|
CVE-2024-32456
|
Envo Extra [envo-extra] < 1.8.12 |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') |
Medium
5.4
|
< 1.8.12
|
1.8.12 |
2024-04-15 |
—
|
CVE-2024-32456
The Envo Extra plugin contains a stored cross-site scripting vulnerability in versions 1.8.11 and earlier that arises from inadequate sanitization of user-supplied attributes and insufficient escaping of output. Attackers with at least contributor-level permissions can exploit this flaw to inject malicious scripts into pages, which then execute for any user viewing those pages. The vulnerability was fixed in version 1.8.12.
Based on public CVE data (MITRE/NVD).
Scan your WordPress site free
No signup, no credit card — enter your URL and get a security report in seconds.
See the full security page for this plugin
Browse the CVE database
Browse all security findings