CVE-2024-6158

The Category Posts Widget WordPress plugin before 4.9.17, term-and-category-based-posts-widget WordPress plugin before 4.9.13 does not validate and escape some of its "Category Posts" widget settings before outputting them back in a page/post where the Widget is embed, which could allow high...

WordPress Category Posts Widget Plugin < 4.9.17 is vulnerable to Cross Site Scripting (XSS)

Software Category Posts Widget Type Plugin Vulnerable versions 4.9.17 Fixed in 4.9.17 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-6158 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 321a7aaf8265 Credits Dmitrii Ignatyev Required privile...

CVE-2024-6158

The Category Posts Widget WordPress plugin before 4.9.17, term-and-category-based-posts-widget WordPress plugin before 4.9.13 does not validate and escape some of its "Category Posts" widget settings before outputting them back in a page/post where the Widget is embed, which could allow high...

CVE-2024-6158

The Category Posts Widget and term-and-category-based-posts-widget WordPress plugins are vulnerable to Stored Cross-Site Scripting (XSS) . Specifically, versions before 4.9.17 (Category Posts Widget) and before 4.9.13 (term-and-category-based-posts-widget) fail to validate and escape certain "Cat...