CVE-2024-11719

MEDIUM

Tarteaucitron-wp <0.3.0 - XSS

Title source: llm

Description

The tarteaucitron-wp WordPress plugin before 0.3.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.

References (1)

[Exploit, Third Party Advisory] https://wpscan.com/vulnerability/64c2a296-5fc6-450e-a12d-75cbf8b73e3a/

Scores

CVSS v3 6.1

EPSS 0.0008

EPSS Percentile 22.7%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Classification

CWE

CWE-352

Status published

Affected Products (1)

couleurcitron/tarteaucitron-wp < 0.3.0

Timeline

Published May 15, 2025

Tracked Since Feb 18, 2026