CVE-2024-10309
Last modified
CVE-2024-10309 is a medium-severity vulnerability rated 5.9/10 on the CVSS scale. The Tracking Code Manager WordPress plugin before 2.4.0 does not sanitise and escape some of its metabox settings when outputing them in the page, which could allow users with a role as low as Contributor to perform Cross-Site Scripting attacks.. EPSS estimates a 0.25% chance of exploitation in the next 30 days.
Description
The Tracking Code Manager WordPress plugin before 2.4.0 does not sanitise and escape some of its metabox settings when outputing them in the page, which could allow users with a role as low as Contributor to perform Cross-Site Scripting attacks.
Metrics
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Data443 | Tracking Code Manager | < 2.4.0 |
References
- https://wpscan.com/vulnerability/9eb21250-34bd-4600-a0a5-7c5117f69f04/Exploit, Third Party Advisory
- https://wpscan.com/vulnerability/9eb21250-34bd-4600-a0a5-7c5117f69f04/Exploit, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2024-10309?
How severe is CVE-2024-10309?
How do I fix CVE-2024-10309?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2024
- CVE-2024-10301A vulnerability, which was classified as critical, was found…7.2
- CVE-2024-10302The user self-signup flow in multiple WSO2 products fails to…5.8
- CVE-2024-10305Rejected reason: This CVE ID has been rejected or withdrawn …
- CVE-2024-10306A vulnerability was found in mod_proxy_cluster. The issue is…5.4
- CVE-2024-10307An issue has been discovered in GitLab EE/CE affecting all v…5.5
- CVE-2024-10308The Jeg Elementor Kit plugin for WordPress is vulnerable to …5.4
- CVE-2024-1031A vulnerability was found in CodeAstro Expense Management Sy…6.1
- CVE-2024-10310The Element Pack Elementor Addons (Header Footer, Template L…5.4
- CVE-2024-10311The External Database Based Actions plugin for WordPress is …8.8
- CVE-2024-10312The Exclusive Addons for Elementor plugin for WordPress is v…4.3
- CVE-2024-10313iniNet Solutions SpiderControl SCADA PC HMI Editor has a pat…8.6
- CVE-2024-10314In Helix Core versions prior to 2024.2, an unauthenticated r…8.7
Are you affected by CVE-2024-10309?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST