CVE-2024-5647
Multiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Magnific Popups JavaScript Library
- State
- Published
- Severity
- 6.4 Medium
- Published
- Jul 3, 2025
- Updated
- Aug 25, 2026
- Reserved
- Jun 4, 2024
Description
Multiple plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled Magnific Popups library (version 1.1.0) in various versions due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. NOTE: This vulnerability was fixed in the upstream library (Magnific Popups version 1.2.0) by disabling the loading of HTML within certain fields by default.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 6.4 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N | Wordfence |
Weaknesses
- CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected Products
| Product | Versions |
|---|---|
BlossomThemes Social Feedblossomthemes |
|
Carousel Slidersayful |
|
Supreme Modules Lite – Divi Theme, Extra Theme and Divi Builderdivisupreme |
|
Robo Gallery – Photo & Image Sliderrobosoft |
|
Gutentor – Gutenberg Blocks – Page Builder for Gutenberg Editorgutentor |
|
OceanWPoceanwp |
|
Happy Addons for Elementorleevio |
|
Divi Torque Litebadhonrocks |
|
Divi BuilderElegant Themes |
|
DiviElegant Themes |
|
Divi ExtraElegant Themes |
|
Bold Page Builderboldthemes |
|
Essential Addons for Elementor – Popular Elementor Templates & Widgetswpdevteam |
|
Shortcodes Ultimate – Content Elementsgn_themes |
|
BethemeMuffinGroup |
|
References
- https://www.wordfence.com/threat-intel/vulnerabilities/id/dae80fc2-3076-4a32-876d-5df1c62de9bd?source=cve
- https://plugins.trac.wordpress.org/browser/shortcodes-ultimate/trunk/vendor/magnific-popup/magnific-popup.js
- https://plugins.trac.wordpress.org/browser/essential-addons-for-elementor-lite/trunk/assets/front-end/js/lib-view/magnific-popup/jquery.magnific-popup.js
- https://plugins.trac.wordpress.org/browser/bold-page-builder/trunk/content_elements_misc/js/jquery.magnific-popup.js
- https://plugins.trac.wordpress.org/changeset/3154460/happy-elementor-addons
- https://plugins.trac.wordpress.org/changeset/3153781/bold-page-builder
- https://plugins.trac.wordpress.org/browser/robo-gallery/trunk/js/robo_gallery.js#L56
- https://www.elegantthemes.com/api/changelog/divi.txt
- https://www.elegantthemes.com/api/changelog/extra.txt
- https://www.elegantthemes.com/api/changelog/divi-builder.txt
- https://themes.trac.wordpress.org/changeset/244604/oceanwp
- https://plugins.trac.wordpress.org/changeset/3153700/essential-addons-for-elementor-lite
- https://plugins.trac.wordpress.org/changeset/3184626/addons-for-divi
- https://plugins.trac.wordpress.org/changeset/3201991/robo-gallery
- https://plugins.trac.wordpress.org/changeset/3166204/carousel-slider
- https://github.com/dimsemenov/Magnific-Popup/releases/tag/1.2.0
- https://plugins.trac.wordpress.org/changeset/3328729/shortcodes-ultimate
- https://support.muffingroup.com/changelog/
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.