CVE-2024-2846

The Visual Footer Credit Remover plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'selector' parameter in all versions up to, and including, 2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

• CWE-79

• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3081401%40visual-footer-credit-remover&new=3081401%40visual-footer-credit-remover&sfp_email=&sfph_mail=
• https://www.wordfence.com/threat-intel/vulnerabilities/id/9fcb65a0-4218-4728-9c29-0d1a03f438a6?source=cve
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3081401%40visual-footer-credit-remover&new=3081401%40visual-footer-credit-remover&sfp_email=&sfph_mail=
• https://www.wordfence.com/threat-intel/vulnerabilities/id/9fcb65a0-4218-4728-9c29-0d1a03f438a6?source=cve

Published

May 14, 2024

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-28442Directory Traversal vulnerability in Yealink VP59 v.91.15.0.…7.5
• CVE-2024-28446Shenzhen Libituo Technology Co., Ltd LBT-T300-mini1 v1.2.9 w…5.7
• CVE-2024-28447Shenzhen Libituo Technology Co., Ltd LBT-T300-mini1 v1.2.9 w…6.5
• CVE-2024-2845The BetterDocs – Best Documentation, FAQ & Knowledge Base Pl…6.4
• CVE-2024-28456Cross Site Scripting vulnerability in Campcodes Online Marri…5.4
• CVE-2024-28458Null Pointer Dereference vulnerability in swfdump in swftool…7.5
• CVE-2024-2847The WordPress File Upload plugin for WordPress is vulnerable…5.4
• CVE-2024-2848The Responsive theme for WordPress is vulnerable to unauthor…7.5
• CVE-2024-2849A vulnerability classified as critical was found in SourceCo…9.8
• CVE-2024-2850A vulnerability was found in Tenda AC15 15.03.05.18 and clas…9.8
• CVE-2024-2851A vulnerability was found in Tenda AC15 15.03.05.18/15.03.20…9.8
• CVE-2024-28515Buffer Overflow vulnerability in CSAPP_Lab CSAPP Lab3 15-213…9.8