CVE-2024-12595

CVE-2024-12595 concerns the AHAthat Plugin for WordPress (versions ≤ 1.6). The issue is a reflected XSS caused by the plugin not escaping the PHP global $_SERVER['REQUEST_URI'] when it is echoed back inside an HTML attribute. This can enable a attacker-controlled input to be reflected in the page...

CVE-2024-11269

The CVE-2024-11269 entry concerns the WordPress AHAthat Plugin (versions 1.6 and earlier). The vulnerability is an Admin-level SQL injection caused by not sanitizing/escaping a parameter before use in a SQL statement, enabling an administrator to perform injection attacks. Reports from Red Hat an...