CVE-2024-4214 LOW

CVE-2024-4214: WordPress cardealer plugin <= 4.15 - Content Injection vulnerability

Vendor Bill Minozzi

Product Car Dealer

Weakness CWE-80 · XSS · basic

Published May 17, 2024

Last update April 28, 2026

View on NVD All CVEs

CVSS base score

2.7/10

Attack vector Network

Attack complexity Low

Privileges required High

User interaction None

Confidentiality None

Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N

What the vulnerability does

01Description

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS vulnerability in Bill Minozzi Car Dealer allows Code Injection.This issue affects Car Dealer: from n/a through 4.15.

Explanation of Vulnerability in Simple Terms

02Summary

Car Dealer versions up to 4.15 contain a low-severity integrity issue affecting high-privilege users. An authenticated administrator can modify data in limited ways due to improper input validation. The vulnerability requires high-level account access and does not affect confidentiality or availability. Update to a version newer than 4.15 when available.

What an attacker can do

03Attacker Capabilities

Modify site data if they have high-level administrative access.

Potential impact on your site

04Site Impact

A compromised admin account could make unauthorized data changes; monitor admin activity and enforce strong passwords.

Conditions required to exploit

05Prerequisites

Attacker must have high-privilege (administrator-level) account on the site.

Key dates

06Disclosure timeline

May 17, 2024 CVE published

April 28, 2026 Record updated

External resources

07References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2024-4214 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/80.html AskarLabs — CWE-80 write-up Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

Related vulnerabilities