CVE-2024-10103

{"id": "CVE-2024-10103", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}]}, "published": "2024-11-19T06:15:17.740", "references": [{"url": "https://wpscan.com/vulnerability/89660883-5f34-426a-ad06-741c0c213ecc/", "tags": ["Exploit", "Third Party Advisory"], "source": "[email protected]"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "In the process of testing the MailPoet WordPress plugin before 5.3.2, a vulnerability was found that allows you to implement Stored XSS on behalf of the editor by embedding malicious script, which entails account takeover backdoor"}, {"lang": "es", "value": "En el proceso de prueba del complemento MailPoet para WordPress anterior a la versi\u00f3n 5.3.2, se encontr\u00f3 una vulnerabilidad que permite implementar XSS almacenado en nombre del editor mediante la incorporaci\u00f3n de un script malicioso, lo que implica una puerta trasera de apropiaci\u00f3n de cuentas."}], "lastModified": "2025-06-12T17:01:45.550", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:automattic:mailpoet:*:*:*:*:free:wordpress:*:*", "vulnerable": true, "matchCriteriaId": "CEA42F06-F491-4B16-A25C-C2E59145711E", "versionEndExcluding": "5.3.2"}], "operator": "OR"}]}], "sourceIdentifier": "[email protected]"}