VDB
CVE-2024-4755
CVE-2024-4755
PUBLISHED
CVSS 4.800000190734863 MEDIUM
The Google CSE WordPress plugin through 1.0.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
EPSS 0.26% · 16.2th percentile
Risk Scores
CVSS 3.1
4.800000190734863
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
EPSS Score
0.26%
16.2th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| erikeng | google_cse | 0, 0 |
| Unknown | Google CSE | 0, 0 |
| erikeng | google_cse | 0, 0 |
Timeline
- Jun 21, 2024 EPSS Score
- Jun 21, 2024 CVE Published
- Jul 14, 2024 EPSS Score
- Aug 6, 2024 EPSS Score
- Aug 30, 2024 EPSS Score
- Oct 5, 2024 Coalition ESS Score
- Oct 15, 2024 EPSS Score
- Nov 7, 2024 EPSS Score
- Dec 2, 2024 EPSS Score
- Dec 25, 2024 EPSS Score
- Jan 17, 2025 EPSS Score
- Feb 9, 2025 EPSS Score