CVE-2021-24305

The Target First WordPress Plugin v2.0, also previously known as Watcheezy, suffers from a critical unauthenticated stored XSS vulnerability. An attacker could change the licence key value through a POST on any URL with the 'weeWzKey' parameter that will be save as the 'weeID option and is not...

Cross site scripting

The Target First WordPress Plugin v2.0, also previously known as Watcheezy, suffers from a critical unauthenticated stored XSS vulnerability. An attacker could change the licence key value through a POST on any URL with the 'weeWzKey' parameter that will be save as the 'weeID option and is not...

CVE-2021-24305

The CVE-2021-24305 entry describes a stored, unauthenticated XSS in the Target First WordPress Plugin v2.0 (Watcheezy). The vulnerability is triggered via a POST that includes the parameter weeWzKey , which is saved as the weeID option without sanitization. The impact is that an attacker can modi...

PT-2021-15842

Name of the Vulnerable Software and Affected Versions Target First WordPress Plugin version 2.0 Description The issue is related to a critical unauthenticated stored XSS vulnerability. An attacker can modify the licence key value by sending a POST request to any URL with the weeWzKey parameter,...

CVE-2021-24305: Improper Neutralization of Input During Web Page Generation

The Target First WordPress Plugin v2.0, also previously known as Watcheezy, suffers from a critical unauthenticated stored XSS vulnerability. An attacker could change the licence key value through a POST on any URL with the 'weeWzKey' parameter that will be save as the 'weeID option and is not...

Target First Plugin 2.0 - Unauthenticated Stored XSS via Licence Key

The Target First WordPress Plugin, also previously known as Watcheezy, suffered from a critical unauthenticated stored XSS vulnerability. An attacker could change the licence key value through a POST on any URL with the "weeWzKey" parameter that will be save as the "weeID" option. The input value...