{"id":"CVE-2024-4477","aliases":["EUVD-2024-44091","GHSA-wvh4-52xx-9r94"],"status":"published","title":"WP Logs Book \u003c= 1.0.1 - Unauthenticated Stored XSS","description":"The WP Logs Book WordPress plugin through 1.0.1 does not sanitise and escape some of its log data before outputting them back in an admin dashboard, leading to an Unauthenticated Stored Cross-Site Scripting","severity":{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.00307,"percentile":0.23782,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-79"],"published":"2024-06-21T06:00:04Z","modified":"2026-06-17T08:01:57Z","products":[{"vendor":"onetarek","product":"wp-logs-book"},{"vendor":"onetarek","product":"wp_logs_book"},{"vendor":"unknown","product":"wp logs book"}],"references":[{"url":"https://wpscan.com/vulnerability/ab551552-944c-4e2a-9355-7011cbe553b0/","tags":["exploit","vdb-entry","technical-description","x_transferred","Exploit","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-4477"},{"url":"https://wpscan.com/vulnerability/ab551552-944c-4e2a-9355-7011cbe553b0"},{"url":"https://github.com/advisories/GHSA-wvh4-52xx-9r94"}],"sources":{"cve":[{"id":"CVE-2024-4477","title":"WP Logs Book \u003c= 1.0.1 - Unauthenticated Stored XSS","description":"The WP Logs Book WordPress plugin through 1.0.1 does not sanitise and escape some of its log data before outputting them back in an admin dashboard, leading to an Unauthenticated Stored Cross-Site Scripting","status":"published","published":"2024-06-21T06:00:04.995Z","modified":"2024-08-01T20:40:47.341Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L","level":"medium","assessor":"adp"}],"updated_at":"2026-11-02T14:34:17.150655Z"}],"euvd":[{"id":"EUVD-2024-44091","description":"The WP Logs Book WordPress plugin through 1.0.1 does not sanitise and escape some of its log data before outputting them back in an admin dashboard, leading to an Unauthenticated Stored Cross-Site Scripting","status":"published","published":"2024-06-21T06:00:04Z","modified":"2024-08-01T20:40:47Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-03T03:50:36.775345Z"}],"ghsa":[{"id":"GHSA-wvh4-52xx-9r94","title":"The WP Logs Book WordPress plugin through 1.0.1 does not sanitise and escape some of its log data...","description":"The WP Logs Book WordPress plugin through 1.0.1 does not sanitise and escape some of its log data before outputting them back in an admin dashboard, leading to an Unauthenticated Stored Cross-Site Scripting","status":"published","published":"2024-06-21T06:31:13Z","modified":"2024-06-24T21:34:20Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:57:31.517228Z"}],"nvd":[{"id":"CVE-2024-4477","description":"The WP Logs Book WordPress plugin through 1.0.1 does not sanitise and escape some of its log data before outputting them back in an admin dashboard, leading to an Unauthenticated Stored Cross-Site Scripting","status":"published","published":"2024-06-21T06:15:12.347Z","modified":"2026-06-17T08:01:57.277Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:10:07.173605Z"}]}}