Canva ortto authorization issue vulnerability

Versions of Canva Ortto prior to 1.0.25 contain an authorization issue vulnerability. This vulnerability arises from the lack of authentication for configuration update requests; it relies solely on a key exposed in public HTML, potentially allowing unauthenticated attackers to override plugin...

Canva ortto cross-site scripting vulnerability

Versions of Canva Ortto prior to 1.0.25 contain a cross-site scripting vulnerability. This flaw stems from the lack of escaping of settings stored on the administration page, potentially enabling stored cross-site scripting attacks. Attackers can modify plugin configurations and execute arbitrary...