CVE-2024-9177

MEDIUM 5.4CVE-2024-9177 · Published 26/09/2024 · updated 17/06/2026

In short

CVE-2024-9177 is a MEDIUM (CVSS 5.4) vulnerability affecting toolbox (themedy).
Chance of exploitation in the next 30 days (EPSS): 0.40%, higher than 34.0% of all vulnerabilities.
Fix: update to 1.0.16 or later.

Package	Affected versions	Patched versions
toolbox themedy	`< 1.0.16`	`1.0.16`

Description

The Themedy Toolbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's themedy_col, themedy_social_link, themedy_alertbox, and themedy_pullleft shortcodes in all versions up to, and including, 1.0.14, and up to, and including 1.0.15 for the plugin's themedy_button shortcode due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

References

plugins.trac.wordpress.org/changeset/3157836 · Patch
wordpress.org/plugins/themedy-toolbox · Release Notes
wordfence.com/threat-intel/vulnerabilities/id/755e0998-0f0d-4259-881d-ed07aecb0b10 · Third Party Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free