5 matches found
CVE-2023-5057
CVE-2023-5057 affects the ActivityPub for WordPress plugin prior to 1.0.0. The vulnerability arises because the plugin does not escape user metadata before outputting it in mentions, enabling Stored XSS by a Contributor+ user. Impact is stored cross-site scripting via mentions in affected WordPre...
CVE-2023-3746
The CVE-2023-3746 refers to the ActivityPub for WordPress plugin (pre-1.0.1) where post content was not properly sanitized/escaped, enabling Stored XSS by contributors and higher. Public details consistently state the vulnerability stems from insufficient sanitization of post content, allowing an...
CVE-2023-3707
CVE-2023-3707 concerns the ActivityPub for WordPress plugin (pre-1.0.0). It allows an authenticated user (e.g., a subscriber) to disclose contents of arbitrary posts (including drafts and private posts) via an IDOR vector, with password‑protected posts unaffected. The issue’s root cause is improp...
CVE-2023-3706
The CVE-2023-3706 entry corresponds to the WordPress ActivityPub plugin (pre-1.0.0). It describes an IDOR flaw where an authenticated user (e.g., a subscriber) can retrieve the title of arbitrary posts, including drafts and private posts, via a post ID because the plugin does not ensure that titl...