12 Step Meeting List 3.17 - 3.19.16 - Unauthenticated Stored XSS via Geocode Event Log

Description The plugin does not sanitise and escape a value submitted by unauthenticated users before storing it in its activity log and outputting it back in an admin area page, leading to a Stored Cross-Site Scripting issue which could be used against high privilege users such as admin. PoC The...

12 Step Meeting List < 3.19.17 - Unauthenticated Stored Cross-Site Scripting

Description The 12 Step Meeting List plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 3.19.16. This is due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

CVE-2024-22296 WordPress 12 Step Meeting List plugin <= 3.14.28 - Broken Access Control vulnerability

Missing Authorization vulnerability in Code for Recovery 12 Step Meeting List.This issue affects 12 Step Meeting List: from n/a through 3.14.28...

WordPress 12 Step Meeting List Plugin <= 3.14.33 is vulnerable to Cross Site Scripting (XSS)

Software 12 Step Meeting List Type Plugin Vulnerable versions = 3.14.33 Fixed in 3.14.34 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-35693 Patch priority Medium CVSS severity Medium 7.1 Developer Code for Recovery PSID 8149c3967f73 Credits alien8 Required...