CVE-2024-5647

Multiple plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled Magnific Popups library (version 1.1.0) in various versions due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. NOTE: This vulnerability was fixed in the upstream library (Magnific Popups version 1.2.0) by disabling the loading of HTML within certain fields by default.

• CWE-79

• https://github.com/dimsemenov/Magnific-Popup/releases/tag/1.2.0
• https://plugins.trac.wordpress.org/browser/bold-page-builder/trunk/content_elements_misc/js/jquery.magnific-popup.js
• https://plugins.trac.wordpress.org/browser/essential-addons-for-elementor-lite/trunk/assets/front-end/js/lib-view/magnific-popup/jquery.magnific-popup.js
• https://plugins.trac.wordpress.org/browser/robo-gallery/trunk/js/robo_gallery.js#L56
• https://plugins.trac.wordpress.org/browser/shortcodes-ultimate/trunk/vendor/magnific-popup/magnific-popup.js
• https://plugins.trac.wordpress.org/changeset/3153700/essential-addons-for-elementor-lite
• https://plugins.trac.wordpress.org/changeset/3153781/bold-page-builder
• https://plugins.trac.wordpress.org/changeset/3154460/happy-elementor-addons
• https://plugins.trac.wordpress.org/changeset/3166204/carousel-slider
• https://plugins.trac.wordpress.org/changeset/3184626/addons-for-divi
• https://plugins.trac.wordpress.org/changeset/3201991/robo-gallery
• https://themes.trac.wordpress.org/changeset/244604/oceanwp
• https://www.elegantthemes.com/api/changelog/divi-builder.txt
• https://www.elegantthemes.com/api/changelog/divi.txt
• https://www.elegantthemes.com/api/changelog/extra.txt
• https://www.wordfence.com/threat-intel/vulnerabilities/id/dae80fc2-3076-4a32-876d-5df1c62de9bd?source=cve

Published

Jul 3, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-56462IBM QRadar 7.5.0 through 7.5.0 UP15 Interim Fix 002 could al…8.8
• CVE-2024-56463IBM QRadar SIEM 7.5 is vulnerable to cross-site scripting. T…4.8
• CVE-2024-56464IBM QRadar SIEM 7.5 - 7.5.0 UP14 IF01 is affected by an info…2.7
• CVE-2024-56467IBM EntireX 11.1 could allow a local user to obtain sensitiv…3.3
• CVE-2024-56468IBM InfoSphere Data Replication VSAM for z/OS Remote Source …6.5
• CVE-2024-56469IBM UrbanCode Deploy (UCD) 7.1 through 7.1.2.22, 7.2 through…6.3
• CVE-2024-56470IBM Aspera Shares 1.9.0 through 1.10.0 PL6 is vulnerable to…5.4
• CVE-2024-56471IBM Aspera Shares 1.9.0 through 1.10.0 PL6 is vulnerable to…5.4
• CVE-2024-56472IBM Aspera Shares 1.9.0 through 1.10.0 PL6 is vulnerable to…5.4
• CVE-2024-56473IBM Aspera Shares 1.9.0 through 1.10.0 PL6 could allow an a…5.3
• CVE-2024-56474IBM TXSeries for Multiplatforms 9.1 and 11.1 is vulnerable t…8.8
• CVE-2024-56475IBM TXSeries for Multiplatforms 9.1 and 11.1 is vulnerable t…5.4