6.4
Medium
CVE-2024-5647 Multiple plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled Magnific Popups…
Description
Multiple plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled Magnific Popups library (version 1.1.0) in various versions due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. NOTE: This vulnerability was fixed in the upstream library (Magnific Popups version 1.2.0) by disabling the loading of HTML within certain fields by default.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| BlossomThemes Social Feed 2.0 | earliest → 2.0.5 | No fix stated |
| Carousel Slider 2.2 | earliest → 2.2.14 | No fix stated |
| Supreme Modules Lite – Divi Theme, Extra Theme and Divi Builder 2.5 | earliest → 2.5.52 | No fix stated |
| Photo Gallery, Images, Slider in Rbs Image Gallery 3.2 | earliest → 3.2.22 | No fix stated |
| Gutentor – Gutenberg Blocks – Page Builder for Gutenberg Editor 3.4 | earliest → 3.4.9 | No fix stated |
| OceanWP 3.6 | earliest → 3.6.0 | No fix stated |
| Happy Addons for Elementor 3.12 | earliest → 3.12.2 | No fix stated |
| Divi Torque – Plugin for Divi Theme and Builder 4.0 | earliest → 4.0.5 | No fix stated |
| Divi Builder 4.27 | earliest → 4.27.1 | No fix stated |
Show the 12 other branches Hide the 12 other branches
| Product | Affected versions | Fixed in |
|---|---|---|
| Divi 4.27 | earliest → 4.27.1 | No fix stated |
| Divi Extra 4.27 | earliest → 4.27.1 | No fix stated |
| Bold Page Builder 5.1 | earliest → 5.1.2 | No fix stated |
| Essential Addons for Elementor – Popular Elementor Templates and Widgets 6.0 | earliest → 6.0.4 | No fix stated |
| WP Shortcodes Plugin — Shortcodes Ultimate 7.4 | earliest → 7.4.2 | No fix stated |
| Carousel Slider 2.2 | earliest → 2.2.14 | No fix stated |
| Robo Gallery – Photo & Image Slider 3.2 | earliest → 3.2.22 | No fix stated |
| Happy Addons for Elementor 3.12 | earliest → 3.12.2 | No fix stated |
| Divi Torque Lite 4.0 | earliest → 4.0.5 | No fix stated |
| Essential Addons for Elementor – Popular Elementor Templates & Widgets 6.0 | earliest → 6.0.4 | No fix stated |
| Shortcodes Ultimate – Content Elements 7.4 | earliest → 7.4.2 | No fix stated |
| Betheme 28.4 | earliest → 28.4 | No fix stated |