CVE-2024-5647
MediumCVSS 6.4Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
Multiple plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled Magnific Popups library (version 1.1.0) in various versions due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. NOTE: This vulnerability was fixed in the upstream library (Magnific Popups version 1.2.0) by disabling the loading of HTML within certain fields by default.
Risk Assessment
An attacker can inject malicious scripts that execute in users' browsers, potentially leading to session theft, account takeover, or malware distribution.
Recommendation
It is recommended to update all WordPress plugins to versions that use Magnific Popups 1.2.0 or later, and to regularly update plugins and the WordPress core.
Other vulnerabilities in WordPress plugins
See all- CVE-2026-4375Critical
The DoLeads Integrator and wp2epub WordPress plugins (versions up to 0.65) allow remote code execution (RCE) once installed on a blog. The vulnerability stems from the ability to install extensions from wordpress.org by unauthorized users.
- CVE-2026-93031High
The WP Cloud Plugins Use-your-Drive, Out-of-the-Box, Share-one-Drive, and Lets-Box plugins for WordPress are vulnerable to Arbitrary File Upload in all versions from 2.0 up to, and including, 3.8.3 via the download_file_to_uploads function. This is due to the import action being registered for unauthenticated users via wp_ajax_nopriv_, a missing capability check in can_import(), and the imported file's extension and contents not being validated against get_allowed_mime_types() before it is written to the uploads directory. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload files that may be executable, which makes remote code execution possible.
Original NVD description (English source)
Multiple plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled Magnific Popups library (version 1.1.0) in various versions due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. NOTE: This vulnerability was fixed in the upstream library (Magnific Popups version 1.2.0) by disabling the loading of HTML within certain fields by default.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS