CVE-2024-12734

The CVE-2024-12734 entry covers the Advance Post Prefix WordPress plugin (versions through 1.1.1). Affected component: the plugin’s parameter output path where unsanitized/unescaped input is echoed back in the page, causing a Reflected Cross-Site Scripting (XSS) vulnerability. Root cause: imprope...

CVE-2024-12735

The CVE-2024-12735 entry concerns the WordPress plugin Advance Post Prefix (versions ≤ 1.1.1). The root cause is failure to sanitize/escape a parameter before its use in a SQL statement, enabling Admins+ to perform SQL injection. Mitigations documented include upgrading to a fixed version (per PT...