CVE-2024-6536
Published: 30 July 2024
Summary
CVE-2024-6536 is a medium-severity Cross-site Scripting (CWE-79) vulnerability in Dylanjkotze Zephyr Project Manager. Its CVSS base score is 5.4 (Medium).
Operationally, ranked in the top 2.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
The Zephyr Project Manager WordPress plugin before version 3.3.99 is affected by a stored cross-site scripting vulnerability tracked as CVE-2024-6536. The flaw stems from insufficient sanitization and escaping of certain plugin settings and is classified under CWE-79 with a CVSS 3.1 score of 5.4.
High-privilege users such as editors and administrators can exploit the issue to perform stored XSS attacks. This remains possible even when the unfiltered_html capability is disabled, for instance in multisite WordPress configurations, potentially allowing injected scripts to execute in other users' browsers.
The WPScan advisory for the vulnerability points to the affected plugin versions and indicates that the issue is resolved by updating to 3.3.99 or later. The associated EPSS score has remained flat at 0.5197 with no material increase observed since disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-47613
Vulnerability details
The Zephyr Project Manager WordPress plugin before 3.3.99 does not sanitise and escape some of its settings, which could allow high privilege users such as editors and admins to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is…
more
disallowed (for example in multisite setup)
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Penetration testing submits XSS payloads to web applications, detecting cross-site scripting flaws for subsequent remediation.
Validates web inputs to reject script-related content that could produce XSS.
Output validation against expected content can reject or sanitize script content in generated web pages, reducing XSS exploitability.