Medium severity5.4NVD Advisory· Published Jul 12, 2024· Updated Jun 17, 2026

CVE-2024-2640

Description

The Watu Quiz WordPress plugin before 3.4.1.2 does not sanitise and escape some of its settings, which could allow users such as authors (if they've been authorized by admins) to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Kibokolabs/Watu Quiz
cpe:2.3:a:kibokolabs:watu_quiz:*:*:*:*:*:wordpress:*:*
Range: <3.4.1.2
WordPress/Watu Quizcpe-rescue2 versions
(expand)+ 1 more
- (no CPE)
- (no CPE)range: <3.4.1.2
Package: https://wordpress.org/plugins/watu-quiz

Patches

Vulnerability mechanics

References

wpscan.com/vulnerability/d46db635-9d84-4268-a789-406a0db4cccf/nvdExploitThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.351
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000