CVE-2024-39310

The Basil recipe theme for WordPress is vulnerable to Persistent Cross-Site Scripting (XSS) via the `post_title` parameter in versions up to, and including, 2.0.4 due to insufficient input sanitization and output escaping. This vulnerability allows authenticated attackers with contributor-level access and above to inject arbitrary web scripts in pages that will execute whenever a user accesses a compromised page. Because the of the default WordPress validation, it is not possible to insert the payload directly but if the Cooked plugin is installed, it is possible to create a recipe post type (cp_recipe) and inject the payload in the title field. Version 2.0.5 contains a patch for the issue.

• CWE-79

• https://github.com/XjSv/Basil/commit/e2b1dbf1637d1ec2663f9aa1a563b02dc76a8146
• https://github.com/XjSv/Basil/security/advisories/GHSA-cr7v-8v2h-49vx
• https://github.com/XjSv/Basil/commit/e2b1dbf1637d1ec2663f9aa1a563b02dc76a8146
• https://github.com/XjSv/Basil/security/advisories/GHSA-cr7v-8v2h-49vx

Published

Jul 1, 2024

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-39305Envoy is a cloud-native, open source edge and service proxy.…9.1
• CVE-2024-39306Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2024-39307Kavita is a cross platform reading server. Opening an ebook …3.5
• CVE-2024-39308RailsAdmin is a Rails engine that provides an interface for …5.4
• CVE-2024-39309Parse Server is an open source backend that can be deployed …9.8
• CVE-2024-3931A vulnerability was found in Totara LMS up to 18.7. It has b…5.4
• CVE-2024-39311Publify is a self hosted Web publishing platform on Rails. P…5.4
• CVE-2024-39312Botan is a C++ cryptography library. X.509 certificates can …5.3
• CVE-2024-39313toy-blog is a headless content management system implementat…5.3
• CVE-2024-39314toy-blog is a headless content management system implementat…4.7
• CVE-2024-39315Pomerium is an identity and context-aware access proxy. Prio…6.5
• CVE-2024-39316Rack is a modular Ruby web server interface. Starting in ver…6.5