Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
4.8

PeepSo plugin for WordPress allows hackers to inject malicious scripts

CVE-2024-7655 · published 2 years ago
Summary

The PeepSo plugin for WordPress has a security flaw that allows hackers to inject malicious scripts into certain pages. This can only happen if the site has multiple installations and the site owners have restricted the use of certain HTML tags. To stay safe, update to the latest version of the plugin or contact your web developer to fix the issue.

What to do
  • Update peepso peepso to version 6.4.6.0 or later.
Affected software
VendorProductAffected versions
peepso peepso < 6.4.6.0
cpe:2.3:a:peepso:peepso:*:*:*:*:*:wordpress:*:*
Original advisory text
The Community by PeepSo – Social Network, Membership, Registration, User Profiles plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 6.4.5.0 due...
The Community by PeepSo – Social Network, Membership, Registration, User Profiles plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 6.4.5.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
4.8 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published10 Sep 2024
Updated4 Nov 2026
First seen7 Mar 2026
Sources
CVE-2024-7655 · NVD
Track software like this
Free during beta