CVE-2024-12717

CVE-2024-12717 affects the Aklamator INfeed WordPress plugin (≤2.0.0); insufficient sanitization/escaping of settings can let high-privilege users (e.g., Admin) perform Stored XSS even when unfiltered_html is disallowed (e.g., multisite). Public remediation/fix details are not provided in the sup...

CVE-2024-12731

CVE-2024-12731 describes a Reflected XSS in the Aklamator INfeed WordPress plugin up to version 2.0.0. The flaw arises from insufficient sanitisation/escaping of a parameter before it is echoed back on the page, enabling an attacker to craft a payload that could affect high-privilege users (e.g.,...