WordPress Elespare plugin <= 3.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Horizontal Nav Menu Widget vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Horizontal Nav Menu Widget vulnerability discovered by stealthcopter in WordPress Plugin Elespare versions = 3.1.2...

WordPress Elespare Plugin <= 3.1.2 is vulnerable to Cross Site Scripting (XSS)

Software Elespare Type Plugin Vulnerable versions = 3.1.2 Fixed in 3.2.0 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-4615 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 21ccc5e387f4 Credits stealthcopter Required privileg...

WordPress Elespare plugin <= 2.1.2 - Missing Authorization to Subscriber+ Arbitrary Post Creation vulnerability

Missing Authorization to Subscriber+ Arbitrary Post Creation vulnerability discovered by Lucio Sá in WordPress Plugin Elespare versions = 2.1.2...