{"id":"CVE-2024-4477","state":"PUBLISHED","title":"WP Logs Book <= 1.0.1 - Unauthenticated Stored XSS","description":"The WP Logs Book WordPress plugin through 1.0.1 does not sanitise and escape some of its log data before outputting them back in an admin dashboard, leading to an Unauthenticated Stored Cross-Site Scripting","publishedAt":"2024-06-21T06:00:04.995Z","updatedAt":"2024-08-01T20:40:47.341Z","severity":{"score":4.3,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L","source":"CISA-ADP"},"assigner":"WPScan","products":["Unknown WP Logs Book"],"affected":[{"vendor":"Unknown","product":"WP Logs Book","defaultStatus":"affected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"1.0.1","versionType":"semver"}]}],"references":["https://wpscan.com/vulnerability/ab551552-944c-4e2a-9355-7011cbe553b0/"],"weaknesses":[],"ingestedAt":"2026-10-29T20:07:56.516Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/4xxx/CVE-2024-4477.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2024-4477","state":"PUBLISHED","datePublished":"2024-06-21T06:00:04.995Z","dateUpdated":"2024-08-01T20:40:47.341Z","assignerShortName":"WPScan","assignerOrgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","dateReserved":"2024-05-03T19:34:58.394Z"},"containers":{"cna":{"title":"WP Logs Book <= 1.0.1 - Unauthenticated Stored XSS","descriptions":[{"lang":"en","value":"The WP Logs Book WordPress plugin through 1.0.1 does not sanitise and escape some of its log data before outputting them back in an admin dashboard, leading to an Unauthenticated Stored Cross-Site Scripting"}],"affected":[{"vendor":"Unknown","product":"WP Logs Book","defaultStatus":"affected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"1.0.1","versionType":"semver"}]}],"references":[{"url":"https://wpscan.com/vulnerability/ab551552-944c-4e2a-9355-7011cbe553b0/","tags":["exploit","vdb-entry","technical-description"]}],"problemTypes":[{"descriptions":[{"description":"CWE-79 Cross-Site Scripting (XSS)","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"WPScan","orgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","dateUpdated":"2024-06-21T06:00:04.995Z"},"credits":[{"lang":"en","value":"Bob Matyas","type":"finder"},{"lang":"en","value":"WPScan","type":"coordinator"}],"source":{"discovery":"EXTERNAL"},"x_generator":{"engine":"WPScan CVE Generator"}},"adp":[{"title":"CISA ADP Vulnrichment","affected":[{"vendor":"onetarek","product":"wp-logs-book","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"1.0.1","versionType":"semver"}],"cpes":["cpe:2.3:a:onetarek:wp-logs-book:*:*:*:*:*:*:*:*"]}],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":4.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L","integrityImpact":"LOW","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"LOW","privilegesRequired":"HIGH","confidentialityImpact":"LOW"}},{"other":{"type":"ssvc","content":{"timestamp":"2024-06-25T18:52:48.270280Z","id":"CVE-2024-4477","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-07-11T14:24:35.827Z"}},{"title":"CVE Program Container","references":[{"url":"https://wpscan.com/vulnerability/ab551552-944c-4e2a-9355-7011cbe553b0/","tags":["exploit","vdb-entry","technical-description","x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-01T20:40:47.341Z"}}]}}}