CVE-2024-29803 MEDIUM

CVE-2024-29803: WordPress FlatPM plugin < 3.1.05 - Cross Site Scripting (XSS) vulnerability

Vendor Mehanoid.pro

Product FlatPM

Weakness CWE-79 · XSS

Published March 27, 2024

Last update April 28, 2026

View on NVD All CVEs

CVSS base score

6.5/10

Attack vector Network

Attack complexity Low

Privileges required Low

User interaction Required

Confidentiality Low

Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

What the vulnerability does

01Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mehanoid.Pro FlatPM allows Stored XSS.This issue affects FlatPM: from n/a before 3.1.05.

Key dates

02Disclosure timeline

March 27, 2024 CVE published

April 28, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2024-29803

Related vulnerabilities

04Related CVE

CVE-2023-1179 SourceCodester Computer Parts Sales and Inventory System Add Supplier cross site scripting CVE-2024-1266 CodeAstro University Management System Student Registration Form st_reg.php cross site scripting CVE-2021-24455 Tutor LMS < 1.9.2 - Authenticated Stored Cross-Site Scripting (XSS) CVE-2025-6674 CKEditor5 Youtube - Moderately critical - Cross-site Scripting - SA-CONTRIB-2025-081 CVE-2025-7672 Stored-XSS possibility in Namo CrossEditor4