CVE-2021-24305

The CVE-2021-24305 entry describes a stored, unauthenticated XSS in the Target First WordPress Plugin v2.0 (Watcheezy). The vulnerability is triggered via a POST that includes the parameter weeWzKey , which is saved as the weeID option without sanitization. The impact is that an attacker can modi...

Target First Plugin 2.0 - Unauthenticated Stored XSS via Licence Key

The Target First WordPress Plugin, also previously known as Watcheezy, suffered from a critical unauthenticated stored XSS vulnerability. An attacker could change the licence key value through a POST on any URL with the "weeWzKey" parameter that will be save as the "weeID" option. The input value...