PT-2024-23065

Name of the Vulnerable Software and Affected Versions WPFront Notification Bar versions 3.3.2 and earlier Description The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacker can...

WordPress Plugin WPFront Notification Bar: Cross-site Scripting Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed in the PHP language that supports personal blogs on PHP and MySQL servers.WordPress plugin is an application...

WordPress WPFront Notification Bar Plugin <= 3.3.2 is vulnerable to Cross Site Scripting (XSS)

Software WPFront Notification Bar Type Plugin Vulnerable versions = 3.3.2 Fixed in 3.4 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-29819 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID bb6b1e52c1e5 Credits Joel Indra Required privilege...

CVE-2024-0625

The WPFront Notification Bar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘wpfront-notification-bar-optionscustomclass’ parameter in all versions up to, and including, 3.3.2 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2024-0625

CVE-2024-0625 describes a stored XSS in the WordPress plugin WPFront Notification Bar (multi-site && unfiltered_html scenarios) via the parameter wpfront-notification-bar-options[custom_class]. Affected: WPFront Notification Bar up to version 3.3.2. Root cause: insufficient input sanitization and...

CVE-2024-0625

The WPFront Notification Bar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘wpfront-notification-bar-optionscustomclass’ parameter in all versions up to, and including, 3.3.2 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2024-0625: Improper Neutralization of Input During Web Page Generation

The WPFront Notification Bar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘wpfront-notification-bar-optionscustomclass’ parameter in all versions up to, and including, 3.3.2 due to insufficient input sanitization and output escaping. This makes it possible for...

WordPress plugin WPFront Notification Bar security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in the...

PT-2024-15701 · WordPress · Wpfront Notification Bar

Name of the Vulnerable Software and Affected Versions: WPFront Notification Bar plugin for WordPress versions up to, and including, 3.3.2 Description: The issue is related to Stored Cross-Site Scripting via the wpfront-notification-bar-optionscustom class parameter due to insufficient input...

WordPress WPFront User Role Editor plugin cross-site scripting vulnerability

WordPress is the Wordpress Foundation's set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. WordPress WPFront User Role Editor plugin has a cross-site scripting vulnerability in versions prior to...

CVE-2021-24984

The WPFront User Role Editor WordPress plugin before 3.2.1.11184 does not sanitise and escape the changes-saved parameter before outputting it back in the admin dashboard, leading to a Reflected Cross-Site Scripting...

CVE-2021-24984

The WPFront User Role Editor WordPress plugin before 3.2.1.11184 does not sanitise and escape the changes-saved parameter before outputting it back in the admin dashboard, leading to a Reflected Cross-Site Scripting...

CVE-2021-24984

The WPFront User Role Editor WordPress plugin before 3.2.1.11184 does not sanitise and escape the changes-saved parameter before outputting it back in the admin dashboard, leading to a Reflected Cross-Site Scripting...

Cross site scripting

The WPFront User Role Editor WordPress plugin before 3.2.1.11184 does not sanitise and escape the changes-saved parameter before outputting it back in the admin dashboard, leading to a Reflected Cross-Site Scripting...

CVE-2021-24984: Improper Neutralization of Input During Web Page Generation

The WPFront User Role Editor WordPress plugin before 3.2.1.11184 does not sanitise and escape the changes-saved parameter before outputting it back in the admin dashboard, leading to a Reflected Cross-Site Scripting...

PT-2021-16393

Name of the Vulnerable Software and Affected Versions: WPFront User Role Editor WordPress plugin versions prior to 3.2.1.11184 Description: The issue is related to a Reflected Cross-Site Scripting problem. It occurs because the changes-saved parameter is not properly sanitised and escaped before...

WordPress WPFront User Role Editor plugin <= 3.1.0.10272 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by JrXnm in WordPress WPFront User Role Editor plugin versions = 3.1.0.10272. Solution Update the WordPress WPFront User Role Editor plugin to the latest available version at least 3.2.1.11184...

WPFront User Role Editor < 3.2.1.11184 - Reflected Cross-Site Scripting

The plugin does not sanitise and escape the changes-saved parameter before outputting it back in the admin dashboard, leading to a Reflected Cross-Site Scripting...

WPFront User Role Editor < 3.2.1.11184 - Reflected Cross-Site Scripting

The plugin does not sanitise and escape the changes-saved parameter before outputting it back in the admin dashboard, leading to a Reflected Cross-Site Scripting PoC...

CVE-2021-24601

The WPFront Notification Bar WordPress plugin before 2.1.0.08087 does not properly sanitise and escape its settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...