---
id: "CVE-2024-3586"
kind: "vulnerability"
aliases: ["CVE-2024-3586"]
title: "LetterPress WordPress plugin: settings allow stored cross-site scripting by admins"
severity: "low"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["letterpress", "multisite", "package", "wordpress"]
not_affected_if: ["no-letterpress-plugin", "plugin-2.4.0-or-later"]
published_at: "2026-10-29T06:17:16+00:00"
first_seen_at: "2026-10-29T06:53:12+00:00"
updated_at: "2026-10-29T06:55:00+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-3586", "first_seen_at": "2026-10-29T06:53:12+00:00"}]
---

# LetterPress WordPress plugin: settings allow stored cross-site scripting by admins

The LetterPress WordPress plugin before 2.4.0 does not sanitise or escape some of its settings. A high-privilege user such as an administrator can store cross-site scripting payloads even where unfiltered HTML is disallowed, as in multisite installs.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed LetterPress plugin version in the WordPress admin Plugins screen; versions before `2.4.0` are affected.
- Confirm whether the site runs multisite or restricts the `unfiltered_html` capability for administrators.

## Fix

- LetterPress plugin: move to `2.4.0` or later.

## Timeline

- 2026-10-29T06:53:12+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2024-3586

## From the sources

The LetterPress  WordPress plugin before 2.4.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_