CVE-2024-12872

The Zalomení WordPress plugin through 1.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-12872

The Zalomení WordPress plugin, affecting versions 1.5 and earlier , contains a Stored Cross-Site Scripting (XSS) vulnerability. The root cause is a failure to properly sanitise and escape certain settings, which can be exploited by high privilege users (such as admins). This risk remains even if ...