CVE-2024-4135

EUVD-2024-32695
The WP Latest Posts plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.0.7. This is due to the plugin allowing users to execute an action that does not properly validate a user-supplied value prior to using that value in a call to do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
Code Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
WordfenceCNA
5.4 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 76%
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
joomunitedwp_latest_posts
𝑥
≤ 5.0.7
CNA
Common Weakness Enumeration
References
https://plugins.trac.wordpress.org/changeset/3081119/wp-latest-posts
https://www.wordfence.com/threat-intel/vulnerabilities/id/57d90ba7-b655-4655-981c-548ff96c3bb7?source=cve
https://plugins.trac.wordpress.org/changeset/3081119/wp-latest-posts
https://www.wordfence.com/threat-intel/vulnerabilities/id/57d90ba7-b655-4655-981c-548ff96c3bb7?source=cve