CVE-2024-11645

creationtimestamp| type| source ---|---|--- 2024-12-27 06:11:48+00:00| seen| https://infosec.exchange/users/cve/statuses/113723304061600264 2024-12-27 06:15:42+00:00| seen| https://bsky.app/profile/cve-notifications.bsky.social/post/3lebdmbap452l 2024-12-27 07:37:33+00:00| seen|...

CVE-2024-11645 Float Block <= 1.7 - Admin+ Stored XSS via Widget

The float block WordPress plugin through 1.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-11645

The float block WordPress plugin (versions 1.7 and earlier ) is vulnerable to Stored Cross-Site Scripting (XSS) due to insufficient sanitization and escaping of certain settings. This flaw could allow high-privilege users, such as administrators, to execute XSS attacks, even in environments where...