CVE-2024-8799

CVE-2024-8799 affects the WordPress plugin Custom Banners (versions ≤ 3.3), enabling unauthenticated Reflected Cross-Site Scripting via add_query_arg usage without proper escaping. Root cause: URL handling weakness in the plugin enables injection in pages executed by users; impact is reflected XS...

CVE-2021-4407

The CVE-2021-4407 issue affects the Custom Banners WordPress plugin, where Cross-Site Request Forgery is possible due to missing/incorrect nonce validation in saveCustomFields(). Versions up to and including 3.2.2 are affected. Attackers without authentication could cause changes by tricking an a...