CVE-2024-6859 WP MultiTasking <= 0.1.12 - Reflected XSS via Shortcode

The WP MultiTasking WordPress plugin through 0.1.12 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

CVE-2024-6852 WP MultiTasking <= 0.1.12 - Settings Update via CSRF

The WP MultiTasking WordPress plugin through 0.1.12 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...

CVE-2024-6853

The CVE CVE-2024-6853 concerns WP MultiTasking for WordPress, affected in versions

CVE-2024-6856

CVE-2024-6856 affects the WordPress plugin WP MultiTasking (versions up to 0.1.12). The root cause is a missing CSRF check when updating plugin settings, enabling a logged-in attacker to modify settings through a CSRF attack. Exploitation details are not provided beyond this description in the co...

CVE-2024-6853: Cross-Site Request Forgery (CSRF)

The WP MultiTasking WordPress plugin through 0.1.12 does not have CSRF check when updating welcome popups, which could allow attackers to make logged admins perform such action via a CSRF attack...

CVE-2024-6859: Improper Neutralization of Input During Web Page Generation

The WP MultiTasking WordPress plugin through 0.1.12 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

CVE-2024-6852: Cross-Site Request Forgery (CSRF)

The WP MultiTasking WordPress plugin through 0.1.12 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...

WordPress plugin WP MultiTasking 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...

CVE-2024-6856: Cross-Site Request Forgery (CSRF)

The WP MultiTasking WordPress plugin through 0.1.12 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...

CVE-2024-6855: Cross-Site Request Forgery (CSRF)

The WP MultiTasking WordPress plugin through 0.1.12 does not have CSRF check when updating exit popups, which could allow attackers to make logged admins perform such action via a CSRF attack...

PT-2024-37908

Name of the Vulnerable Software and Affected Versions WP MultiTasking WordPress plugin versions 0.1.12 and earlier Description The issue is related to the lack of CSRF protection when updating settings in the WP MultiTasking WordPress plugin. This could allow attackers to make a logged-in admin...

WordPress WP MultiTasking plugin <= 0.1.12 - Reflected XSS via Shortcode vulnerability

Reflected XSS via Shortcode vulnerability discovered by Bob Matyas in WordPress Plugin WP MultiTasking versions = 0.1.12...

WordPress WP MultiTasking plugin <= 0.1.12 - Multiple CSRF vulnerability

Multiple CSRF vulnerability discovered by Norbert Hofmann in WordPress Plugin WP MultiTasking versions = 0.1.12...

WordPress WP MultiTasking Plugin <= 0.1.12 is vulnerable to Cross Site Scripting (XSS)

Software WP MultiTasking Type Plugin Vulnerable versions = 0.1.12 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-6859 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 5ed370bec785 Credits Bob Matyas Required...