Fiche vulnérabilité
CVE-2024-13419 : faille moyenne g5plus april (CVSS 5.4)
Description
Multiple plugins and/or themes for WordPress using Smart Framework are vulnerable to Stored Cross-Site Scripting due to a missing capability check on the saveOptions() and importThemeOptions() functions in various versions. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update the plugin's settings which includes custom JavaScript that is enabled site-wide. This issue was escalated to Envato over two months from the date of this disclosure and the issue is still vulnerable.
En bref
- Sévérité
- Moyenne (CVSS 5.4)
- Vecteur CVSS
- CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
- Exploitation active
- Non signalée par la CISA
- Publication
- 2 mai 2025
- Dernière mise à jour
- 17 juin 2026
Produits concernés
- g5plus april
- g5plus auteur
- g5plus benaa
- g5plus beyot