CVE-2024-4756 WP Backpack <= 2.1 - Admin+ Stored XSS

The WP Backpack WordPress plugin through 2.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-4756 WP Backpack <= 2.1 - Admin+ Stored XSS

The WP Backpack WordPress plugin through 2.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-4756

CVE-2024-4756 affects the WP Backpack WordPress plugin up to version 2.1. Root cause: the plugin does not sanitise/escape certain settings, enabling stored XSS by high-privilege users (e.g., admin) even when unfiltered_html is disallowed (such as multisite). Exploit details are not provided in th...

WordPress WP Backpack Plugin <= 2.1 is vulnerable to Cross Site Scripting (XSS)

Software WP Backpack Type Plugin Vulnerable versions = 2.1 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-4756 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID cb14ff5810b9 Credits Bob Matyas Required privilege...