CVE-2024-9771

WP-Recall < 16.26.12 - Admin+ Stored XSS

Low · published April 28, 2025

CVSS v3.1
3.5
EPSS
0%
Percentile
17.9
In the wild
Unconfirmed
What it is

The WP-Recall WordPress plugin before 16.26.12 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).

The record
Technical detail
CVSS v3.1
3.5 · LOW
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00268 · 17.9th percentile
Published
2025-04-28T06:00Z
EPSS history
Timeline
  • 28 APR 06:00Z
    WP-Recall < 16.26.12 - Admin+ Stored XSS
    cvelistv5