Lucene search

PatchstackCVE-2024-37422

HistoryJul 22, 2024 - 9:15 a.m.

CVE-2024-37422

2024-07-2209:15:09

CWE-79

Patchstack

web.nvd.nist.gov

cve-2024-37422

xss

cross-site scripting

team emilia

progress planner

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

EPSS

Percentile

14.5%

JSON

Improper Neutralization of Input During Web Page Generation (XSS or ‘Cross-site Scripting’) vulnerability in Team Emilia Projects Progress Planner allows Stored XSS.This issue affects Progress Planner: from n/a through 0.9.2.

Affected configurations

Nvd

Vulners

Vulnrichment

Node

emiliaprojectsprogress_plannerRange<0.9.3wordpress

VendorProductVersionCPE
emiliaprojectsprogress_planner*cpe:2.3:a:emiliaprojects:progress_planner:*:*:*:*:*:wordpress:*:*

Vendor	Product	Version	CPE
emiliaprojects	progress_planner	*	cpe:2.3:a:emiliaprojects:progress_planner::::::wordpress::*

CNA Affected

[
  {
    "collectionURL": "https://wordpress.org/plugins",
    "defaultStatus": "unaffected",
    "packageName": "progress-planner",
    "product": "Progress Planner",
    "vendor": "Team Emilia Projects",
    "versions": [
      {
        "changes": [
          {
            "at": "0.9.3",
            "status": "unaffected"
          }
        ],
        "lessThanOrEqual": "0.9.2",
        "status": "affected",
        "version": "n/a",
        "versionType": "custom"
      }
    ]
  }
]

References

patchstack.com/database/vulnerability/progress-planner/wordpress-progress-planner-plugin-0-9-2-cross-site-scripting-xss-vulnerability?_s_id=cve