CVE-2024-31380

Improper Control of Generation of Code ('Code Injection') vulnerability in Soflyy Oxygen Builder allows Code Injection. Vendor is ignoring report, refuses to patch the issue.This issue affects Oxygen Builder: from n/a through 4.9.

Score

CVSS 3.1 9.9 Critical

Status

Deferred - audit@patchstack.com

Published

2024-04-03

Last modified

2026-04-28

Weaknesses

CWE-94

Affected products

• Oxygen (Soflyy)
• Oxygen Builder (Soflyy)

References

• https://patchstack.com/database/vulnerability/oxygen/wordpress-oxygen-plugin-4-8-1-auth-remote-code-execution-rce-vulne…
• https://snicco.io/vulnerability-disclosure/oxygen/client-control-remote-code-execution-oxygen-4-8-1