CVE-2024-2931

CVE-2024-2931 affects the WordPress plugin WPFront User Role Editor. The vulnerability enables Sensitive Information Exposure via the wpfront_user_role_editor_assign_roles_user_autocomplete AJAX action. It allows authenticated attackers with subscriber-level access and above to retrieve the list ...

CVE-2021-24984

CVE-2021-24984 affects the WPFront User Role Editor WordPress plugin prior to version 3.2.1.11184. The issue stems from insufficient sanitisation and escaping of the changes-saved parameter before it is output in the admin dashboard, enabling a Reflected Cross-Site Scripting (XSS) condition. Impa...