6.4Media

CVE-2024-11450ONLYOFFICE Docs <= 2.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

onlyoffice ONLYOFFICE Docs Publicada: 2024-12-06 11:24 (hace 1 año)

Descripción

The ONLYOFFICE Docs plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'onlyoffice' shortcode in all versions up to, and including, 2.0.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Debilidad (CWE): CWE-79

Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.

Productos y versiones afectados

Fabricante	Producto	Versiones
onlyoffice	ONLYOFFICE Docs	≤ 2.0.0

Referencias y parches

Puntuación CVSS

6.4Media

Fuente: Wordfence · CVSS 3.1

Vector de ataque: Red
Complejidad: Baja
Privilegios: Bajos
Interacción del usuario: Ninguna
Alcance: Cambiado
Confidencialidad: Bajo
Integridad: Bajo
Disponibilidad: Ninguno

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

EPSS (probabilidad de explotación en 30 días)

0.26%

superior al 18 % de todas las CVE

Evaluación de CISA (SSVC)

Explotación: none
Automatizable: no
Impacto técnico: partial

Cronología

ID reservado2024-11-19
Publicada2024-12-06 11:24
Llegó a IP-DB2026-10-24 23:55
Última actualización2026-04-08 20:03

Asignada por (CNA): Wordfence

Ver en la fuente: CVE.org · NVD

Reciba un aviso cuando estos productos tengan una vulnerabilidad nueva

Activar alertas por correo

Gratis · con cuenta · se desactiva cuando quiera

CVE recientes del mismo producto — WordPress plugins & themes

7.1Alta

CVE-2026-119517 hace 6 horas

WordPress Catna – Woo Name Your Price and Offers plugin <= 2.0.3 - Cross Site Scripting (XSS) vulnerability

VillaTheme Catna – Woo Name Your Price and Offers

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VillaTheme Catna – Woo Name Your Price and Offers catna-woo-name-your-price-and-offers allows Reflected XSS.This issue affects Catna – Woo Name Your Price an…

9.3Crítica

CVE-2026-124415 hace 6 horas

WordPress Alex Reservations plugin <= 2.4.8 - SQL Injection vulnerability

Alejandro Alex Reservations

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Alejandro Alex Reservations alex-reservations allows SQL Injection.This issue affects Alex Reservations: from n/a through 2.4.8.

5.3Media

CVE-2026-125432 hace 6 horas

WordPress reCAPTCHA for WooCommerce plugin <= 1.4.7 - Broken Authentication vulnerability

RelyWP reCAPTCHA for WooCommerce

Weak Password Recovery Mechanism for Forgotten Password vulnerability in RelyWP reCAPTCHA for WooCommerce recaptcha-woo allows Password Recovery Exploitation.This issue affects reCAPTCHA for WooCommerce: from n/a through 1.4.7.

8.5Alta

CVE-2026-124265 hace 6 horas

WordPress Newsletters plugin <= 4.18.1 - SQL Injection vulnerability

Tribulant Software Newsletters

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Tribulant Software Newsletters newsletters-lite allows Blind SQL Injection.This issue affects Newsletters: from n/a through 4.18.1.

7.5Alta

CVE-2026-124267 hace 6 horas

WordPress Gmail SMTP plugin <= 1.2.3.23 - Broken Access Control vulnerability

Noor Alam Gmail SMTP

Missing Authorization vulnerability in Noor Alam Gmail SMTP gmail-smtp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Gmail SMTP: from n/a through 1.2.3.23.

7.1Alta

CVE-2026-124410 hace 6 horas

WordPress Translate and boost SEO – Automatic AI translation – wpLingua plugin <= 3.1.1 - Cross Site Scripting (XSS) vulnerability

wpLingua Translation Service Translate and boost SEO – Automatic AI translation – wpLingua

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpLingua Translation Service Translate and boost SEO – Automatic AI translation – wpLingua wplingua allows Stored XSS.This issue affects Translat…