WordPress Plugin Vulnerabilities

Fan Page Widget by ThemeNcode < 2.1 - Admin+ Stored XSS

Description

The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

Affects Plugins

Plugin icon
facebook-fan-page-widget
Fixed in 2.1

References

CVE
CVE-2024-33695
URL
https://patchstack.com/database/vulnerability/facebook-fan-page-widget/wordpress-fan-page-widget-by-themencode-plugin-2-0-cross-site-scripting-xss-vulnerability

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
3.5 (low)

Miscellaneous

Original Researcher
Joshua Chan
Verified
No
WPVDB ID
04a8549a-0827-4ad4-b3aa-be2a640c1b3e

Timeline

Publicly Published
2024-04-26 (about 2 years ago)
Added
2024-05-01 (about 2 years ago)
Last Updated
2024-05-08 (about 2 years ago)

Other

Published
Title
Published
2026-06-17
Title
SysBasics Customize My Account for WooCommerce < 4.3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Published
2026-07-02
Title
RTMKit < 2.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Advanced Heading Widget 'Background Text' Parameter
Published
2024-05-30
Title
YITH WooCommerce Wishlist < 3.33.0 - Authenticated (Admin+) Stored Cross-Site Scripting
Published
2021-09-07
Title
Weather Effect < 1.3.6 - Admin+ Stored Cross-Site Scripting
Published
2025-02-22
Title
Accept Donations with PayPal & Stripe < 1.4.5 - Reflected Cross-Site Scripting