CVE-2024-10309

The Tracking Code Manager WordPress plugin before 2.4.0 does not sanitise and escape some of its metabox settings when outputing them in the page, which could allow users with a role as low as Contributor to perform Cross-Site Scripting attacks...

CVE-2024-10309

creationtimestamp| type| source ---|---|--- 2025-01-30 06:09:16+00:00| seen| https://infosec.exchange/users/cve/statuses/113915812623981683 2025-01-30 06:15:37+00:00| seen| https://bsky.app/profile/cve-notifications.bsky.social/post/3lgwthfi5732n 2025-01-30 07:11:30+00:00| seen|...

CVE-2024-10309 Tracking Code Manager < 2.4.0 - Contributor+ Stored XSS

The Tracking Code Manager WordPress plugin before 2.4.0 does not sanitise and escape some of its metabox settings when outputing them in the page, which could allow users with a role as low as Contributor to perform Cross-Site Scripting attacks...

CVE-2024-10309

The Tracking Code Manager WordPress plugin, in versions prior to 2.4.0 , is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is the failure to sanitise and escape certain metabox settings when they are outputted on a page. This flaw allows users with privileges as low as Contribut...

CVE-2024-10309 Tracking Code Manager < 2.4.0 - Contributor+ Stored XSS

The Tracking Code Manager WordPress plugin before 2.4.0 does not sanitise and escape some of its metabox settings when outputing them in the page, which could allow users with a role as low as Contributor to perform Cross-Site Scripting attacks...