PT-2024-20395 · WordPress · Inline Related Posts

Dmitry Ignatyev · Published 2024-03-27 · Updated 2025-05-08 · CVE-2024-2444

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Inline Related Posts WordPress plugin versions prior to 3.5.0

Description The issue concerns the Inline Related Posts WordPress plugin, which does not properly sanitise and escape some of its settings. This could allow high-privilege users, such as Admin, to perform Cross-Site Scripting attacks, even when unfiltered html is disallowed. Over 100,000 WordPress sites are potentially at risk, and attackers could execute Stored XSS, potentially creating JavaScript backdoors.

Recommendations For versions prior to 3.5.0, update to version 3.5.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the plugin's settings to minimize the risk of exploitation. Avoid using the vulnerable settings in the affected plugin until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-2444

Affected Products

Inline Related Posts

References · 8

• 🔥 https://wpscan.com/vulnerability/214e5fd7-8684-418a-b67d-60b1dcf11a48 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-2444 · Security Note
• https://osv.dev/vulnerability/CVE-2024-2444 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/1776559681214816340 · Twitter Post
• https://t.me/cvenotify/75891 · Telegram Post
• https://twitter.com/cleantalkcloud/status/1773216148898636141 · Twitter Post
• https://twitter.com/CVEnew/status/1776482420654481811 · Twitter Post
• https://t.me/cvenotify/121393 · Telegram Post