CVE-2024-2696

Summary: CVE-2024-2696 affects the socialdriver-framework WordPress plugin. The plugin before 2024.04.30 fails to sanitize/escape certain settings, enabling Stored Cross-Site Scripting by high-privilege users (e.g., administrators) even when unfiltered_html is disallowed (e.g., in multisite). Aff...

CVE-2024-2870

The CVE-2024-2870 concerns the WordPress plugin socialdriver-framework (versions before 2024.04.30). A parameter is not properly sanitized/escaped before being reflected in the page, causing a Reflected Cross‑Site Scripting (XSS) vulnerability. The issue could be exploited against high‑privilege ...

CVE-2024-2697

The CVE CVE-2024-2697 affects the socialdriver-framework WordPress plugin prior to 2024.0.0. The issue is that shortcode attributes are not validated or escaped before output, enabling Stored XSS by low-privilege users (Contributor) against high-privilege users (admins). The Red Hat entry confirm...

CVE-2024-2872

The CVE-2024-2872 entry concerns the socialdriver-framework WordPress plugin, affected versions prior to 2024.04.30. The root cause is inadequate sanitisation and escaping of certain settings, enabling stored XSS by high-privilege users (e.g., Contributors), even when unfiltered_html is disallowe...