CVE-2024-5170

CVE-2024-5170 affects the WordPress plugin “Logo Manager For Enamad” (versions ≤ 0.7.1). The issue is that widget settings are not properly sanitized/escaped, which could allow a high-privilege user (e.g., Administrator) to perform a Stored XSS attack, even when unfiltered_html is disallowed (suc...

CVE-2024-4757

The CVE-2024-4757 entry concerns the WordPress plugin Logo Manager For Enamad (versions up to 0.7.0). The connected sources confirm a CSRF flaw in several areas that allows a logged-in administrator to deliver a Stored XSS payload, due to lack of CSRF checks and missing sanitization/escaping. The...