{"id":"CVE-2024-3586","kind":"vulnerability","aliases":["CVE-2024-3586"],"related":[],"title":"LetterPress WordPress plugin: settings allow stored cross-site scripting by admins","description":"The LetterPress  WordPress plugin before 2.4.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)","summary":"The LetterPress WordPress plugin before 2.4.0 does not sanitise or escape some of its settings. A high-privilege user such as an administrator can store cross-site scripting payloads even where unfiltered HTML is disallowed, as in multisite installs.","severity":"low","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["letterpress","multisite","package","wordpress"],"not_affected_if":["no-letterpress-plugin","plugin-2.4.0-or-later"],"how_to_check":"- Check the installed LetterPress plugin version in the WordPress admin Plugins screen; versions before `2.4.0` are affected.\n- Confirm whether the site runs multisite or restricts the `unfiltered_html` capability for administrators.","fix":"- LetterPress plugin: move to `2.4.0` or later.","status":"open","published_at":"2026-10-29T06:17:16+00:00","first_seen_at":"2026-10-29T06:53:12+00:00","triaged_at":"2026-10-29T06:55:00+00:00","updated_at":"2026-10-29T06:55:00+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-29T06:55:00Z","model":"claude-haiku-5-5","output":{"fix":"- LetterPress plugin: move to `2.4.0` or later.","reach":"network","title":"LetterPress WordPress plugin: settings allow stored cross-site scripting by admins","impact":"medium","summary":"The LetterPress WordPress plugin before 2.4.0 does not sanitise or escape some of its settings. A high-privilege user such as an administrator can store cross-site scripting payloads even where unfiltered HTML is disallowed, as in multisite installs.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","letterpress","multisite"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Admin-stored scripts run in other users' browsers on the site.","analyst_note":"","how_to_check":"- Check the installed LetterPress plugin version in the WordPress admin Plugins screen; versions before `2.4.0` are affected.\n- Confirm whether the site runs multisite or restricts the `unfiltered_html` capability for administrators.","plain_action":"","needs_analyst":false,"not_affected_if":["plugin-2.4.0-or-later","no-letterpress-plugin"],"who_is_affected":"Sites running the LetterPress WordPress plugin before 2.4.0, especially multisite installs where administrators lack unfiltered HTML rights. Exploitation requires an account with high privileges, so sites with no such users are at lower risk. Sites on 2.4.0 or later are not affected.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000689,"input_tokens":4117,"output_tokens":555,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2024':14A,17A '-3586':15A,18A '2.4.0':28B,69C 'admin':12A,87C 'administr':46B 'allow':5A,81C 'attack':95C 'capabl':101C 'could':80C 'cross':8A,50B,92C 'cross-sit':7A,49B,91C 'cve':13A,16A 'disallow':59B,103C 'escap':33B,74C 'even':54B,96C 'exampl':105C 'high':40B,82C 'high-privileg':39B 'html':57B,100C 'instal':63B 'letterpress':1A,19B,24B,65C 'multisit':20B,62B,107C 'packag':21B 'payload':53B 'perform':89C 'plugin':3A,26B,67C 'privileg':41B,83C 'sanitis':31B,72C 'script':10A,52B,94C 'set':4A,37B,78C 'setup':108C 'site':9A,51B,93C 'store':6A,48B,90C 'unfilt':56B,99C 'user':42B,84C 'wordpress':2A,22B,25B,66C","nicknames":[],"mitigations":[],"who_affected":"Sites running the LetterPress WordPress plugin before 2.4.0, especially multisite installs where administrators lack unfiltered HTML rights. Exploitation requires an account with high privileges, so sites with no such users are at lower risk. Sites on 2.4.0 or later are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T06:17:16+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2024-3586","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-3586","severity":null,"published_at":"2026-10-29T06:17:16+00:00","modified_at":"2026-10-29T06:17:16+00:00","first_seen_at":"2026-10-29T06:53:12+00:00","fetched_at":"2026-10-29T06:53:12+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}