CVE-2024-6864

MEDIUM 5.4CVE-2024-6864 · Published 20/08/2024 · updated 17/06/2026

In short

CVE-2024-6864 is a MEDIUM (CVSS 5.4) vulnerability affecting wp last modified info (sayandatta).
Chance of exploitation in the next 30 days (EPSS): 0.33%, higher than 26.2% of all vulnerabilities.
Fix: update to 1.9.1 or later.

Package	Affected versions	Patched versions
wp last modified info sayandatta	`< 1.9.1`	`1.9.1`

Description

The WP Last Modified Info plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘template’ attribute of the lmt-post-modified-info shortcode in all versions up to, and including, 1.9.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

References

plugins.trac.wordpress.org/browser/wp-last-modified-info/trunk/inc/Core/Frontend/PostView.php · Patch
plugins.trac.wordpress.org/changeset/3137253 · Patch
plugins.trac.wordpress.org/changeset/3137253 · Patch
wordpress.org/plugins/wp-last-modified-info · Product
wordfence.com/threat-intel/vulnerabilities/id/87368d85-04d4-42e6-9ba6-2a1fc3b945a8 · Third Party Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free