CVE-2024-11605

The wp-publications WordPress plugin through 1.2 does not escape filenames before outputting them back in the page, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite...

CVE-2024-11605

creationtimestamp| type| source ---|---|--- 2024-12-27 06:11:49+00:00| seen| https://infosec.exchange/users/cve/statuses/113723304031769999 2024-12-27 06:15:38+00:00| seen| https://bsky.app/profile/cve-notifications.bsky.social/post/3lebdm3ocj62c 2024-12-27 07:37:41+00:00| seen|...

CVE-2024-11605

CVE-2024-11605 affects the WordPress plugin wp-publications (versions ≤ 1.2). The vulnerability arises because the plugin does not escape filenames before outputting them in HTML, enabling stored cross-site scripting by high-privilege users (e.g., admins) even when unfiltered_html is disallowed (...

CVE-2024-11605 WP Publications <= 1.2 - Admin+ Stored XSS

The wp-publications WordPress plugin through 1.2 does not escape filenames before outputting them back in the page, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite...

CVE-2024-11605 WP Publications <= 1.2 - Admin+ Stored XSS

The wp-publications WordPress plugin through 1.2 does not escape filenames before outputting them back in the page, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite...