CVE-2024-11645

creationtimestamp| type| source ---|---|--- 2024-12-27 06:11:48+00:00| seen| https://infosec.exchange/users/cve/statuses/113723304061600264 2024-12-27 06:15:42+00:00| seen| https://bsky.app/profile/cve-notifications.bsky.social/post/3lebdmbap452l 2024-12-27 07:37:33+00:00| seen|...

CVE-2024-11645 Float Block <= 1.7 - Admin+ Stored XSS via Widget

The float block WordPress plugin through 1.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-11645

CVE-2024-11645 affects the WordPress plugin float block, version 1.7 and earlier, due to insufficient sanitisation/escaping of certain settings. This could allow high-privilege users (e.g., admins) to perform Stored XSS, including in multisite setups, with unfiltered_html disabled. Connected docu...