---
id: CVE-2024-3586
title: LetterPress < 2.4.0 - Admin+ Stored XSS
summary: >-
  The LetterPress  WordPress plugin before 2.4.0 does not sanitise and escape
  some of its settings, which could allow high privilege users such as admin to
  perform Stored Cross-Site Scripting attacks even when the unfiltered_html
  capabilit…
severity: low
cvss: 3.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N'
cvssSource: adp
cwe:
  - CWE-79
product: LetterPress
affected:
  - LetterPress < 2.4.0
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-29T10:51:46.110487Z'
published: '2026-10-29'
updated: '2026-10-29'
sourceUpdated: '2026-10-29T10:56:08.109Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2024-3586'
references:
  - url: 'https://wpscan.com/vulnerability/8e3291be-265c-4dec-876c-3e8e3ec0443a/'
tags:
  - cve.org
epss: 0.00173
epssPercentile: 0.06832
ingestedAt: '2026-11-01T17:57:46.223Z'
---

## Overview

The LetterPress  WordPress plugin before 2.4.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

## Affected

- `LetterPress < 2.4.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.