{"id":"CVE-2024-3586","title":"LetterPress < 2.4.0 - Admin+ Stored XSS","summary":"The LetterPress  WordPress plugin before 2.4.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capabilit…","severity":"low","cvss":3.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N","cvssSource":"adp","cwe":["CWE-79"],"product":"LetterPress","affected":["LetterPress < 2.4.0"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-10-29T10:51:46.110487Z"},"published":"2026-10-29","updated":"2026-10-29","sourceUpdated":"2026-10-29T10:56:08.109Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2024-3586","references":[{"url":"https://wpscan.com/vulnerability/8e3291be-265c-4dec-876c-3e8e3ec0443a/"}],"tags":["cve.org"],"epss":0.00173,"epssPercentile":0.06832,"ingestedAt":"2026-11-01T17:57:46.223Z","slug":"CVE-2024-3586","body":"## Overview\n\nThe LetterPress  WordPress plugin before 2.4.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)\n\n## Affected\n\n- `LetterPress < 2.4.0`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":19,"depthScoreParts":{"impact":19.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}