Medium severity6.4NVD Advisory· Published Aug 1, 2024· Updated Jun 17, 2026

CVE-2024-5330

Description

The Breakdance plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the breakdance_css_file_paths_cache parameter in all versions up to, and including, 1.7.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Breakdance/Breakdancev5
Range: 0
WordPress/Breakdancellm-fuzzy2 versions
<=1.7.2+ 1 more
- (no CPE)range: <=1.7.2
- (no CPE)
Package: https://wordpress.org/plugins/breakdance
Soflyy/Breakdance
cpe:2.3:a:soflyy:breakdance:*:*:*:*:*:wordpress:*:*
Range: <2.0

Patches

Vulnerability mechanics

References

www.wordfence.com/threat-intel/vulnerabilities/id/9dbd26f5-b75e-41a3-aefb-d6c8cc2cec7bnvdThird Party Advisory
breakdance.com/breakdance-2-0-now-available/nvdRelease Notes

News mentions

No linked articles in our index yet.

cvss	0.416
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000