CVE-2024-5727

The Widget4Call WordPress plugin, in versions 1.0.0 through 1.0.7 , is vulnerable to Reflected Cross-Site Scripting (XSS) . The root cause is the failure to properly sanitise and escape a parameter before it is output back to the page. This vulnerability could be exploited against high-privilege ...

CVE-2024-13099

The Widget4Call WordPress plugin (versions 1.0.0 through 1.0.7 ) is vulnerable to Reflected Cross-Site Scripting (XSS) . The root cause is the failure to properly sanitise and escape a parameter before outputting it back into the page. Attackers can exploit this by crafting a malicious URL to exe...