CVE-2024-5450

CVE-2024-5450 affects the WordPress Bug Library plugin prior to version 2.1.1. The vulnerability arises because the plugin does not validate the file type of files submitted with bug reports, enabling an unauthenticated user to upload PHP files (remote code execution risk). Affected product: Word...

CVE-2024-5604

The CVE-2024-5604 entry maps to the Bug Library WordPress plugin (versions before 2.1.2). The vulnerability arises because the plugin does not sanitize/escape certain settings, enabling stored XSS by high-privilege users (e.g., admins) even when unfiltered_html is disallowed (e.g., multisite). Pu...