CVE-2024-3288
Last modified
CVE-2024-3288 is a medium-severity vulnerability rated 5.4/10 on the CVSS scale. The Logo Slider WordPress plugin before 4.0.0 does not validate and escape some of its Slider Settings before outputting them back in attributes, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. EPSS estimates a 0.29% chance of exploitation in the next 30 days.
Description
The Logo Slider WordPress plugin before 4.0.0 does not validate and escape some of its Slider Settings before outputting them back in attributes, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Logichunt | Logo Slider | < 4.0.0 |
References
- https://wpscan.com/vulnerability/4ef99f54-68df-4353-8fc0-9b09ac0df7ba/Third Party Advisory
- https://wpscan.com/vulnerability/4ef99f54-68df-4353-8fc0-9b09ac0df7ba/Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2024-3288?
How severe is CVE-2024-3288?
How do I fix CVE-2024-3288?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2024
- CVE-2024-32874Frigate is a network video recorder (NVR) with realtime loca…6.8
- CVE-2024-32875Hugo is a static site generator. Starting in version 0.123.0…6.1
- CVE-2024-32876NewPipe is an Android app for video streaming written in Jav…8.5
- CVE-2024-32877Yii 2 is a PHP application framework. During internal penetr…4.7
- CVE-2024-32878Llama.cpp is LLM inference in C/C++. There is a use of unini…8.8
- CVE-2024-32879Python Social Auth is a social authentication/registration m…4.9
- CVE-2024-32880pyload is an open-source Download Manager written in pure Py…7.2
- CVE-2024-32881Danswer is the AI Assistant connected to company's docs, app…9.8
- CVE-2024-32882Wagtail is an open source content management system built on…2.7
- CVE-2024-32883MCUboot is a secure bootloader for 32-bits microcontrollers.…7.7
- CVE-2024-32884gitoxide is a pure Rust implementation of Git. `gix-transpor…6.4
- CVE-2024-32886Vitess is a database clustering system for horizontal scalin…4.9
Are you affected by CVE-2024-3288?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST