CVE-2024-2640

The CVE concerns the WordPress Watu Quiz plugin prior to version 3.4.1.2, where certain settings are not properly sanitised/escaped. This could allow stored XSS by users such as authors (if authorised by admins) even when unfiltered_html is disallowed. Publicly documented details across Red Hat, ...

CVE-2024-2640 Watu Quiz < 3.4.1.2 - Author+ Stored XSS

The Watu Quiz WordPress plugin before 3.4.1.2 does not sanitise and escape some of its settings, which could allow users such as authors if they've been authorized by admins to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

CVE-2024-2640 Watu Quiz < 3.4.1.2 - Author+ Stored XSS

The Watu Quiz WordPress plugin before 3.4.1.2 does not sanitise and escape some of its settings, which could allow users such as authors if they've been authorized by admins to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

WordPress Watu Quiz Plugin < 3.4.1.2 is vulnerable to Cross Site Scripting (XSS)

Software Watu Quiz Type Plugin Vulnerable versions 3.4.1.2 Fixed in 3.4.1.2 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-2640 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 617bfa58ba67 Credits Eunho Kim Required privilege...