CVE-2024-3992
Last modified
CVE-2024-3992 is a medium-severity vulnerability rated 4.8/10 on the CVSS scale. The Amen WordPress plugin through 3.3.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). EPSS estimates a 0.37% chance of exploitation in the next 30 days.
Description
The Amen WordPress plugin through 3.3.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Metrics
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Joshua Vandercar | Amen | <= 3.3.1 |
References
- https://wpscan.com/vulnerability/e9fe3101-8033-4eee-8b37-06856872e9ef/Exploit, Third Party Advisory
- https://wpscan.com/vulnerability/e9fe3101-8033-4eee-8b37-06856872e9ef/Exploit, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2024-3992?
How severe is CVE-2024-3992?
How do I fix CVE-2024-3992?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2024
- CVE-2024-39914FOG is a cloning/imaging/rescue suite/inventory management s…9.8
- CVE-2024-39915Thruk is a multibackend monitoring webinterface for Naemon, …9.9
- CVE-2024-39916FOG is a free open-source cloning/imaging/rescue suite/inven…6.4
- CVE-2024-39917xrdp is an open source RDP server. xrdp versions prior to 0.…9.8
- CVE-2024-39918@jmondi/url-to-png is an open source URL to PNG utility feat…4.3
- CVE-2024-39919@jmondi/url-to-png is an open source URL to PNG utility feat…3.1
- CVE-2024-39920The TCP protocol in RFC 9293 has a timing side channel that …4.3
- CVE-2024-39921Observable timing discrepancy issue exists in IPCOM EX2 Seri…7.5
- CVE-2024-39922A vulnerability has been identified in LOGO! 12/24RCE (6ED10…5.1
- CVE-2024-39923An issue was discovered in Mahara 24.04 before 24.04.2 and 2…6.1
- CVE-2024-39924An issue was discovered in Vaultwarden (formerly Bitwarden_R…8.8
- CVE-2024-39925An issue was discovered in Vaultwarden (formerly Bitwarden_R…6.5
Are you affected by CVE-2024-3992?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST