---
id: CVE-2024-3822
title: >-
  The Base64 Encoder/Decoder WordPress plugin through 0.9.2 does not sanitise
  and escape a parameter before outputting it back in the page, leading to a
  Reflected Cross-Site Scripting which could be used against high privilege
  users such a…
summary: >-
  The Base64 Encoder/Decoder WordPress plugin through 0.9.2 does not sanitise
  and escape a parameter before outputting it back in the page, leading to a
  Reflected Cross-Site Scripting which could be used against high privilege
  users such a…
severity: medium
cvss: 4.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N'
cwe:
  - CWE-79
vendor: mranderson
product: base64_encoder/decoder
affected:
  - base64_encoder/decoder <= 0.9.2
published: '2024-05-15'
updated: '2026-07-29'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2024-3822'
references:
  - url: 'https://wpscan.com/vulnerability/ff5411b1-9e04-4e72-a502-e431d774642a/'
    label: contact@wpscan.com
  - url: 'https://wpscan.com/vulnerability/ff5411b1-9e04-4e72-a502-e431d774642a/'
    label: af854a3a-2127-422b-91ae-364da2661108
tags:
  - nvd
  - exploit-available
epss: 0.00747
epssPercentile: 0.53408
ingestedAt: '2026-07-29T14:48:16.210Z'
exploits:
  nuclei:
    - CVE-2024-3822
  checkedAt: '2026-09-24T07:52:51.517Z'
exploitAvailable: true
---

## Overview

The Base64 Encoder/Decoder WordPress plugin through 0.9.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin

## Affected

- `base64_encoder/decoder <= 0.9.2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.