CVE-2024-2963

CVE-2024-2963 : The Pocket News Generator WordPress plugin is vulnerable to Stored XSS through admin settings (e.g., Consumer Key, Access Token) in all versions up to and including 0.2.0. The issue requires authenticated access with at least administrator-level permissions and affects multisite i...

CVE-2024-2964

CVE-2024-2964 affects the Pocket News Generator WordPress plugin. The Red Hat entry confirms a CSRF vulnerability in all versions up to 0.2.0 caused by missing/incorrect nonce validation in option_page(). This enables unauthenticated attackers to update plugin settings via a forged request if a s...