{"id":"CVE-2024-11107","aliases":["EUVD-2024-34013","GHSA-9m9r-rw59-qh84"],"status":"published","title":"System Dashboard \u003c 2.8.15 - Unauthenticated Stored XSS","description":"The System Dashboard WordPress plugin before 2.8.15 does not sanitise and escape some parameters when outputting them in the page, which could allow unauthenticated users to perform Cross-Site Scripting attacks.","severity":{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-12","score":0.00342,"percentile":0.28053,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-79"],"published":"2024-12-10T06:00:02Z","modified":"2026-06-17T06:57:04Z","products":[{"vendor":"bowo","product":"system_dashboard"},{"vendor":"qriouslad","product":"system dashboard"},{"vendor":"unknown","product":"system dashboard"}],"references":[{"url":"https://wpscan.com/vulnerability/a89f1117-8df3-417b-b54f-6587545833ee/","tags":["exploit","vdb-entry","technical-description","Exploit","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-11107"},{"url":"https://wpscan.com/vulnerability/a89f1117-8df3-417b-b54f-6587545833ee"},{"url":"https://github.com/advisories/GHSA-9m9r-rw59-qh84"}],"sources":{"cve":[{"id":"CVE-2024-11107","title":"System Dashboard \u003c 2.8.15 - Unauthenticated Stored XSS","description":"The System Dashboard WordPress plugin before 2.8.15 does not sanitise and escape some parameters when outputting them in the page, which could allow unauthenticated users to perform Cross-Site Scripting attacks.","status":"published","published":"2024-12-10T06:00:02.187Z","modified":"2024-12-10T15:15:07.287Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"adp"}],"updated_at":"2026-11-02T14:34:19.965827Z"}],"euvd":[{"id":"EUVD-2024-34013","description":"The System Dashboard WordPress plugin before 2.8.15 does not sanitise and escape some parameters when outputting them in the page, which could allow unauthenticated users to perform Cross-Site Scripting attacks.","status":"published","published":"2024-12-10T06:00:02Z","modified":"2024-12-10T15:15:07Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-03T00:04:37.743244Z"}],"ghsa":[{"id":"GHSA-9m9r-rw59-qh84","title":"The System Dashboard WordPress plugin before 2.8.15 does not sanitise and escape some parameters...","description":"The System Dashboard WordPress plugin before 2.8.15 does not sanitise and escape some parameters when outputting them in the page, which could allow unauthenticated users to perform Cross-Site Scripting attacks.","status":"published","published":"2024-12-10T06:31:40Z","modified":"2025-05-17T03:30:31Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:02:20.443164Z"}],"nvd":[{"id":"CVE-2024-11107","description":"The System Dashboard WordPress plugin before 2.8.15 does not sanitise and escape some parameters when outputting them in the page, which could allow unauthenticated users to perform Cross-Site Scripting attacks.","status":"published","published":"2024-12-10T06:15:20.883Z","modified":"2026-06-17T06:57:04.57Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:10:39.434419Z"}]}}