CVE-2024-11190

creationtimestamp| type| source ---|---|--- 2025-05-20 19:42:11+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/17049 2026-05-26 09:08:51+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mmqnfyvpxm2c...

WordPress jwp-a11y plugin <= 4.1.7 - Admin+ Stored XSS vulnerability

Admin+ Stored XSS vulnerability discovered by Taufique Noorani in WordPress Plugin jwp-a11y versions = 4.1.7...

CVE-2024-11190 jwp-a11y <= 4.1.7 - Admin+ Stored XSS

The jwp-a11y WordPress plugin through 4.1.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...