VDB
CVE-2024-12680
CVE-2024-12680
PUBLISHED
CVSS 9.300000190734863 CRITICAL
The Prisna GWT WordPress plugin before 1.4.14 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
EPSS 0.31% · 24.3th percentile
Risk Scores
CVSS 4.0
9.300000190734863
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
EPSS Score
0.31%
24.3th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Unknown | Prisna GWT | 0, 0 |
| prisna | google_website_translator | 0, 0 |
Timeline
- May 15, 2025 CVE Published
- May 16, 2025 EPSS Score
- May 20, 2025 PoC Published
- May 21, 2025 Coalition ESS Score
- May 28, 2025 EPSS Score
- May 28, 2025 Coalition ESS Score
- May 28, 2025 CVE Updated
- Jun 8, 2025 EPSS Score
- Jun 20, 2025 EPSS Score
- Jul 2, 2025 EPSS Score
- Jul 13, 2025 EPSS Score
- Jul 25, 2025 EPSS Score