CVE-2024-35540

Deeper analysis

Typecho version 1.3.0 is affected by a stored cross-site scripting vulnerability that permits attackers to execute arbitrary web scripts or HTML through a crafted payload. The flaw is identified as CVE-2024-35540, carries a CVSS 3.1 score of 9.0, and is categorized under CWE-79.

An attacker with low privileges can exploit the issue remotely by submitting malicious input that is stored and subsequently rendered for other users, resulting in high impact on confidentiality, integrity, and availability with changed scope. The single reference describes multiple vulnerabilities in the same product but provides no mitigation guidance or patch details.

The associated EPSS score reached a peak of 0.0868 from a lower baseline, reflecting modest post-disclosure interest without evidence of widespread exploitation.