CVE-2024-5151

The SULly WordPress plugin versions prior to 4.3.1 are vulnerable to a Stored Cross-Site Scripting (XSS) flaw. The root cause is the failure to properly sanitise and escape certain plugin settings. This allows high-privilege users, such as administrators , to perform Stored XSS attacks, even in e...

CVE-2024-5032

The SULly WordPress plugin before 4.3.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin

CVE-2024-5033

The SULly WordPress plugin (versions prior to 4.3.1 ) is vulnerable to a Cross-Site Request Forgery (CSRF) attack due to a lack of CSRF checks in certain areas, combined with missing sanitization and escaping. This flaw could allow an attacker to trick a logged-in administrator into adding Stored...

CVE-2024-5034

The SULly WordPress plugin before 4.3.1 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks