CVE-2024-9892

The Add Widget After Content plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.4.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

• CWE-79

• https://plugins.trac.wordpress.org/browser/add-widget-after-content/trunk/add-widget-after-content-admin.php#L320Product
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3170427%40add-widget-after-content&new=3170427%40add-widget-after-content&sfp_email=&sfph_mail=
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3170428%40add-widget-after-content&new=3170428%40add-widget-after-content&sfp_email=&sfph_mail=
• https://www.wordfence.com/threat-intel/vulnerabilities/id/e02472a8-5b88-43ad-86f3-e890b49899ad?source=cveThird Party Advisory

Published

Oct 18, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-9886The WP Baidu Map plugin for WordPress is vulnerable to Store…6.4
• CVE-2024-9887The Login using WordPress Users ( WP as SAML IDP ) plugin fo…7.2
• CVE-2024-9888The ElementInvader Addons for Elementor plugin for WordPress…5.4
• CVE-2024-9889The ElementInvader Addons for Elementor plugin for WordPress…4.3
• CVE-2024-9890The User Toolkit plugin for WordPress is vulnerable to authe…8.8
• CVE-2024-9891The Multiline files upload for contact form 7 plugin for Wor…4.3
• CVE-2024-9893The Nextend Social Login Pro plugin for WordPress is vulnera…9.8
• CVE-2024-9894A vulnerability, which was classified as critical, was found…8.8
• CVE-2024-9895The Smart Online Order for Clover plugin for WordPress is vu…5.4
• CVE-2024-9896The BBP Core – Expand bbPress powered forums with useful fea…6.1
• CVE-2024-9897The StreamWeasels Twitch Integration plugin for WordPress is…5.4
• CVE-2024-9898The Parallax Image plugin for WordPress is vulnerable to Sto…5.4