CVE-2024-13123

The AFI WordPress plugin before 1.100.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-13122

The AFI WordPress plugin before 1.100.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-13122

The AFI WordPress plugin (versions prior to 1.100.0 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is that the plugin fails to properly sanitise and escape certain settings, allowing high-privilege users, such as administrators, to execute XSS attacks. This vulnerability pe...

CVE-2024-13123

The AFI WordPress plugin versions prior to 1.100.0 are vulnerable to a Stored Cross-Site Scripting (XSS) attack. The root cause is the failure to properly sanitise and escape certain plugin settings, which allows high-privilege users, such as administrators, to execute malicious scripts. This vul...

CVE-2024-13123 AFI < 1.100.0 - Admin+ Stored XSS

The AFI WordPress plugin before 1.100.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

PT-2025-12754

Name of the Vulnerable Software and Affected Versions AFI WordPress plugin versions prior to 1.100.0 Description The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks. This can occur even when the unfiltered html capability is disallowed, for exampl...

PT-2025-12755

Name of the Vulnerable Software and Affected Versions AFI WordPress plugin versions prior to 1.100.0 Description The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks, even when the unfiltered html capability is disallowed, for example, in a multisi...

CVE-2024-13123: Improper Neutralization of Input During Web Page Generation

The AFI WordPress plugin before 1.100.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...