Medium severity6.1NVD Advisory· Published Mar 18, 2024· Updated Jun 17, 2026

CVE-2024-0711

Description

The Buttons Shortcode and Widget WordPress plugin through 1.16 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Otwthemes/Buttons Shortcode And Widget
cpe:2.3:a:otwthemes:buttons_shortcode_and_widget:*:*:*:*:*:wordpress:*:*
Range: <=1.16
WordPress/Toggles Shortcode And Widgetcpe-rescue
Package: https://wordpress.org/plugins/toggles-shortcode-and-widget
WordPress/Buttons Shortcode and Widgetllm-fuzzy
Range: <=1.16

Patches

Vulnerability mechanics

References

wpscan.com/vulnerability/8e286c04-ef32-4af0-be78-d978999b2a90/nvdExploitThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.397
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000