Live › vulnerability › CVE-2024-3586
The LetterPress WordPress plugin before 2.4.0 does not sanitise or escape some of its settings. A high-privilege user such as an administrator can store cross-site scripting payloads even where unfiltered HTML is disallowed, as in multisite installs.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 06:53 UTC. All times on this page are UTC.
Sites running the LetterPress WordPress plugin before 2.4.0, especially multisite installs where administrators lack unfiltered HTML rights. Exploitation requires an account with high privileges, so sites with no such users are at lower risk. Sites on 2.4.0 or later are not affected.
No product ranges from the sources yet.
2.4.0 are affected.unfiltered_html capability for administrators.2.4.0 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The LetterPress WordPress plugin before 2.4.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
This page as .md · .json · in your agent: get_signal("CVE-2024-3586")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.