4 matches found
CVE-2021-24440
The CVE-2021-24440 issue affects the WordPress Sign-up Sheets plugin for versions before 1.0.14. The root cause is failure to sanitise/escape certain fields when creating a new sheet, enabling authenticated high-privilege users to inject JavaScript and trigger stored XSS when admins view the All ...
CVE-2024-6020
The CVE-2024-6020 entry concerns the Sign-up Sheets WordPress plugin prior to version 2.2.13. The vulnerability arises because generated URLs and the $_SERVER['REQUEST_URI'] value are not properly escaped before being echoed in attributes, enabling Reflected Cross-Site Scripting. Affected softwar...
CVE-2021-24441
CVE-2021-24441 affects the WordPress Sign-up Sheets plugin (versions prior to 1.0.14). The issue is CSV injection arising when exporting CSVs: the plugin does not sanitise or validate the Sheet title during CSV generation, allowing potentially unsafe input to be interpreted as a formula. Public s...