CVE-2024-52794 MEDIUM

CVE-2024-52794: Magnific lightbox susceptible to Cross-site Scripting in Discourse

Vendor Discourse
Product discourse
Weakness CWE-79 · XSS
Published December 19, 2024
Last update December 20, 2024
View on NVD All CVEs

CVSS base score

6.8/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction Required
Confidentiality Low
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:L

What the vulnerability does

01Description

Discourse is an open source platform for community discussion. Users clicking on the lightbox thumbnails could be affected. This problem is patched in the latest version of Discourse. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Key dates

02Disclosure timeline

December 19, 2024 CVE published
December 20, 2024 Record updated

Related vulnerabilities

04Related CVE

CVE-2025-31021 WordPress Mobile Smart plugin <= v1.3.16 - Reflected Cross Site Scripting (XSS) vulnerability CVE-2025-24666 WordPress Hyve Lite plugin <= 1.2.2 - Cross Site Scripting (XSS) vulnerability CVE-2024-10885 SearchIQ – The Search Solution <= 4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2026-25306 WordPress XStore Core plugin <= 5.6.4 - Reflected Cross Site Scripting (XSS) vulnerability CVE-2025-46350 Yeswiki Vulnerable to Authenticated Reflected Cross-site Scripting