{"metadata": {"vulnerability": "CVE-2024-3368", "count": 18, "kinds": {"milestone": 4, "sighting": 4, "kev": 0, "other": 10}}, "data": [{"timestamp": "2024-04-05T08:51:06.596Z", "date_only": false, "value": "2024-04-05T08:51:06.596Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2024-3368", "field": "cveMetadata.dateReserved"}, {"timestamp": "2024-04-11T05:03:27.131Z", "date_only": false, "value": "2024-04-11T05:03:27.131853Z", "kind": "other", "label": "Updated", "source": "gsd \u00b7 GSD-2024-3368", "record": "GSD-2024-3368", "field": "gsd.osvSchema.modified", "linked_record": true}, {"timestamp": "2024-05-20T06:00:01.083Z", "date_only": false, "value": "2024-05-20T06:00:01.083Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2024-3368", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2024-05-20T06:00:01.083Z", "date_only": false, "value": "2024-05-20T06:00:01.083Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / WPScan", "record": "CVE-2024-3368", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2024-05-20T06:15:08Z", "date_only": false, "value": "2024-05-20T06:15:08Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-F2GX-4FP8-9978", "record": "GHSA-F2GX-4FP8-9978", "field": "database_specific.nvd_published_at", "linked_record": true}, {"timestamp": "2024-05-20T06:15:08.527Z", "date_only": false, "value": "2024-05-20T06:15:08.527", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2024-3368", "record": "FKIE_CVE-2024-3368", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2024-05-20T06:30:34Z", "date_only": false, "value": "2024-05-20T06:30:34Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-F2GX-4FP8-9978", "record": "GHSA-F2GX-4FP8-9978", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2024-05-20T11:43:43.506Z", "date_only": false, "value": "2024-05-20T11:43:43.506112Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2024-3368", "field": "containers.adp.0.metrics.1.other.content.timestamp"}, {"timestamp": "2024-05-20T11:43:43.506Z", "date_only": false, "value": "2024-05-20T11:43:43.506112Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2024-3368", "record": "FKIE_CVE-2024-3368", "field": "metrics.ssvcV203.0.ssvcData.timestamp", "linked_record": true}, {"timestamp": "2024-05-21T15:29:59Z", "date_only": false, "value": "2024-05-21T15:29:59.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/HackingInsights/723", "record": "CVE-2024-3368", "field": "creation_timestamp", "uuid": "68019889-e8c6-40a8-a1a8-87f068ff6e01", "content": "\u200aCVE-2024-3368 Vulnerability in All in One SEO Plugin Threatens Millions of WordPress Sites\n\nhttps://securityonline.info/cve-2024-3368-vulnerability-in-all-in-one-seo-plugin-threatens-millions-of-wordpress-sites/", "url": "https://t.me/HackingInsights/723"}, {"timestamp": "2024-05-22T09:27:19Z", "date_only": false, "value": "2024-05-22T09:27:19.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/openSource3/129", "record": "CVE-2024-3368", "field": "creation_timestamp", "uuid": "3f441607-b5ec-4b71-b97e-39c2dbb99b37", "content": "CVE ID : CVE-2024-3368\nSystem : wordpress < 4.6.1.1\nType : Stored xss\n\nExploit :\n\nAs a contributor, create a post and put the following payload in the \"Meta Description\" field:  Save the post (as a draft or submit for review), the XSS will be triggered when any user (like an admin) edit the post again\n\u0627\u0644\u0627\u0633\u062a\u063a\u0644\u0627\u0644 :\n\u0643\u0645\u0633\u0627\u0647\u0645\u060c \u0642\u0645 \u0628\u0625\u0646\u0634\u0627\u0621 \u0645\u0646\u0634\u0648\u0631 \u0648\u0648\u0636\u0639 \u0627\u0644\u0628\u0627\u0644\u0648\u062f \u0627\u0644\u062a\u0627\u0644\u064a \u0641\u064a \u062d\u0642\u0644\n \"Meta Description \": \n\n \u0627\u062d\u0641\u0638 \u0627\u0644\u0645\u0646\u0634\u0648\u0631 (\u0643\u0645\u0633\u0648\u062f\u0629 \u0623\u0648 \u0623\u0631\u0633\u0644\u0647 \u0644\u0644\u0645\u0631\u0627\u062c\u0639\u0629)\u060c \u0648\u0633\u064a\u0642\u0648\u0645 XSS \u0628\u0630\u0644\u0643 \u064a\u062a\u0645 \u062a\u0634\u063a\u064a\u0644\u0647 \u0639\u0646\u062f\u0645\u0627 \u064a\u0642\u0648\u0645 \u0623\u064a \u0645\u0633\u062a\u062e\u062f\u0645 (\u0645\u062b\u0644 \u0627\u0644\u0645\u0633\u0624\u0648\u0644) \u0628\u062a\u062d\u0631\u064a\u0631 \u0627\u0644\u0645\u0646\u0634\u0648\u0631 \u0645\u0631\u0629 \u0623\u062e\u0631\u0649", "url": "https://t.me/openSource3/129", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2024-05-22T09:32:11Z", "date_only": false, "value": "2024-05-22T09:32:11.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/QBqDK5N11DoHS9DV6R6GvVy3iAa2bKhOXUUof8K7tGZD", "record": "CVE-2024-3368", "field": "creation_timestamp", "uuid": "5525b97d-59a3-4f42-8c9b-2a5cbb82d2c9", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2024-08-01T20:05:08.481Z", "date_only": false, "value": "2024-08-01T20:05:08.481Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CVE", "record": "CVE-2024-3368", "field": "containers.adp.1.providerMetadata.dateUpdated"}, {"timestamp": "2025-03-14T17:20:36.410Z", "date_only": false, "value": "2025-03-14T17:20:36.410Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2024-3368", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2025-03-14T17:20:36.410Z", "date_only": false, "value": "2025-03-14T17:20:36.410Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2024-3368", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2025-03-14T17:48:56Z", "date_only": false, "value": "2025-03-14T17:48:56.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/DarkWebInformer_CVEAlerts/7611", "record": "CVE-2024-3368", "field": "creation_timestamp", "uuid": "c485a77a-ba4b-4d3c-8a90-58d686463d9b", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2024-3368\n\ud83d\udd25 CVSS Score: N/A\n\ud83d\udd39 Description: The All in One SEO  WordPress plugin before 4.6.1.1 does not validate and escape some of its Post fields before outputting them back, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks\n\ud83d\udccf Published: 2024-05-20T06:00:01.083Z\n\ud83d\udccf Modified: 2025-03-14T17:20:36.410Z\n\ud83d\udd17 References:\n1. https://wpscan.com/vulnerability/ab78b1a5-e28c-406b-baaf-6d53017f9328/", "url": "https://t.me/DarkWebInformer_CVEAlerts/7611"}, {"timestamp": "2025-03-14T18:30:39Z", "date_only": false, "value": "2025-03-14T18:30:39Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-F2GX-4FP8-9978", "record": "GHSA-F2GX-4FP8-9978", "field": "modified", "linked_record": true}, {"timestamp": "2026-06-17T07:44:08.620Z", "date_only": false, "value": "2026-06-17T07:44:08.620", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2024-3368", "record": "FKIE_CVE-2024-3368", "field": "lastModified", "linked_record": true}], "metrics": {"as_of": "2026-11-10T00:03:45.301Z", "anchors": {"origin": {"timestamp": "2024-05-20T06:00:01.083Z", "date_only": false, "value": "2024-05-20T06:00:01.083Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2024-3368", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2024-05-20T06:00:01.083Z", "date_only": false, "value": "2024-05-20T06:00:01.083Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2024-3368", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": {"timestamp": "2024-05-22T09:27:19Z", "date_only": false, "value": "2024-05-22T09:27:19.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/openSource3/129", "record": "CVE-2024-3368", "field": "creation_timestamp", "uuid": "3f441607-b5ec-4b71-b97e-39c2dbb99b37", "content": "CVE ID : CVE-2024-3368\nSystem : wordpress < 4.6.1.1\nType : Stored xss\n\nExploit :\n\nAs a contributor, create a post and put the following payload in the \"Meta Description\" field:  Save the post (as a draft or submit for review), the XSS will be triggered when any user (like an admin) edit the post again\n\u0627\u0644\u0627\u0633\u062a\u063a\u0644\u0627\u0644 :\n\u0643\u0645\u0633\u0627\u0647\u0645\u060c \u0642\u0645 \u0628\u0625\u0646\u0634\u0627\u0621 \u0645\u0646\u0634\u0648\u0631 \u0648\u0648\u0636\u0639 \u0627\u0644\u0628\u0627\u0644\u0648\u062f \u0627\u0644\u062a\u0627\u0644\u064a \u0641\u064a \u062d\u0642\u0644\n \"Meta Description \": \n\n \u0627\u062d\u0641\u0638 \u0627\u0644\u0645\u0646\u0634\u0648\u0631 (\u0643\u0645\u0633\u0648\u062f\u0629 \u0623\u0648 \u0623\u0631\u0633\u0644\u0647 \u0644\u0644\u0645\u0631\u0627\u062c\u0639\u0629)\u060c \u0648\u0633\u064a\u0642\u0648\u0645 XSS \u0628\u0630\u0644\u0643 \u064a\u062a\u0645 \u062a\u0634\u063a\u064a\u0644\u0647 \u0639\u0646\u062f\u0645\u0627 \u064a\u0642\u0648\u0645 \u0623\u064a \u0645\u0633\u062a\u062e\u062f\u0645 (\u0645\u062b\u0644 \u0627\u0644\u0645\u0633\u0624\u0648\u0644) \u0628\u062a\u062d\u0631\u064a\u0631 \u0627\u0644\u0645\u0646\u0634\u0648\u0631 \u0645\u0631\u0629 \u0623\u062e\u0631\u0649", "url": "https://t.me/openSource3/129", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": true, "seconds": 185237.917, "hours": 51.45497694444444, "days": 2.143957372685185, "min_seconds": 185237.917, "max_seconds": 185237.917, "approximate": false, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2024-05-20T06:00:01.083Z", "date_only": false, "value": "2024-05-20T06:00:01.083Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2024-3368", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2024-05-22T09:27:19Z", "date_only": false, "value": "2024-05-22T09:27:19.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/openSource3/129", "record": "CVE-2024-3368", "field": "creation_timestamp", "uuid": "3f441607-b5ec-4b71-b97e-39c2dbb99b37", "content": "CVE ID : CVE-2024-3368\nSystem : wordpress < 4.6.1.1\nType : Stored xss\n\nExploit :\n\nAs a contributor, create a post and put the following payload in the \"Meta Description\" field:  Save the post (as a draft or submit for review), the XSS will be triggered when any user (like an admin) edit the post again\n\u0627\u0644\u0627\u0633\u062a\u063a\u0644\u0627\u0644 :\n\u0643\u0645\u0633\u0627\u0647\u0645\u060c \u0642\u0645 \u0628\u0625\u0646\u0634\u0627\u0621 \u0645\u0646\u0634\u0648\u0631 \u0648\u0648\u0636\u0639 \u0627\u0644\u0628\u0627\u0644\u0648\u062f \u0627\u0644\u062a\u0627\u0644\u064a \u0641\u064a \u062d\u0642\u0644\n \"Meta Description \": \n\n \u0627\u062d\u0641\u0638 \u0627\u0644\u0645\u0646\u0634\u0648\u0631 (\u0643\u0645\u0633\u0648\u062f\u0629 \u0623\u0648 \u0623\u0631\u0633\u0644\u0647 \u0644\u0644\u0645\u0631\u0627\u062c\u0639\u0629)\u060c \u0648\u0633\u064a\u0642\u0648\u0645 XSS \u0628\u0630\u0644\u0643 \u064a\u062a\u0645 \u062a\u0634\u063a\u064a\u0644\u0647 \u0639\u0646\u062f\u0645\u0627 \u064a\u0642\u0648\u0645 \u0623\u064a \u0645\u0633\u062a\u062e\u062f\u0645 (\u0645\u062b\u0644 \u0627\u0644\u0645\u0633\u0624\u0648\u0644) \u0628\u062a\u062d\u0631\u064a\u0631 \u0627\u0644\u0645\u0646\u0634\u0648\u0631 \u0645\u0631\u0629 \u0623\u062e\u0631\u0649", "url": "https://t.me/openSource3/129", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 78084224.218835, "hours": 21690.06228300972, "days": 903.752595125405, "min_seconds": 78084224.218835, "max_seconds": 78084224.218835, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2024-05-20T06:00:01.083Z", "date_only": false, "value": "2024-05-20T06:00:01.083Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2024-3368", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-10T00:03:45.301Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": true, "seconds": 77898986.301835, "hours": 21638.607306065278, "days": 901.6086377527199, "min_seconds": 77898986.301835, "max_seconds": 77898986.301835, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2024-05-22T09:27:19Z", "date_only": false, "value": "2024-05-22T09:27:19.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/openSource3/129", "record": "CVE-2024-3368", "field": "creation_timestamp", "uuid": "3f441607-b5ec-4b71-b97e-39c2dbb99b37", "content": "CVE ID : CVE-2024-3368\nSystem : wordpress < 4.6.1.1\nType : Stored xss\n\nExploit :\n\nAs a contributor, create a post and put the following payload in the \"Meta Description\" field:  Save the post (as a draft or submit for review), the XSS will be triggered when any user (like an admin) edit the post again\n\u0627\u0644\u0627\u0633\u062a\u063a\u0644\u0627\u0644 :\n\u0643\u0645\u0633\u0627\u0647\u0645\u060c \u0642\u0645 \u0628\u0625\u0646\u0634\u0627\u0621 \u0645\u0646\u0634\u0648\u0631 \u0648\u0648\u0636\u0639 \u0627\u0644\u0628\u0627\u0644\u0648\u062f \u0627\u0644\u062a\u0627\u0644\u064a \u0641\u064a \u062d\u0642\u0644\n \"Meta Description \": \n\n \u0627\u062d\u0641\u0638 \u0627\u0644\u0645\u0646\u0634\u0648\u0631 (\u0643\u0645\u0633\u0648\u062f\u0629 \u0623\u0648 \u0623\u0631\u0633\u0644\u0647 \u0644\u0644\u0645\u0631\u0627\u062c\u0639\u0629)\u060c \u0648\u0633\u064a\u0642\u0648\u0645 XSS \u0628\u0630\u0644\u0643 \u064a\u062a\u0645 \u062a\u0634\u063a\u064a\u0644\u0647 \u0639\u0646\u062f\u0645\u0627 \u064a\u0642\u0648\u0645 \u0623\u064a \u0645\u0633\u062a\u062e\u062f\u0645 (\u0645\u062b\u0644 \u0627\u0644\u0645\u0633\u0624\u0648\u0644) \u0628\u062a\u062d\u0631\u064a\u0631 \u0627\u0644\u0645\u0646\u0634\u0648\u0631 \u0645\u0631\u0629 \u0623\u062e\u0631\u0649", "url": "https://t.me/openSource3/129", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "end": {"timestamp": "2026-11-10T00:03:45.301Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}}}