WordPress Plugin Vulnerabilities

DearFlip < 2.2.27 - Contributor+ Stored XSS

Description

The plugin is vulnerable to Stored Cross-Site Scripting via the 'force_fit ' parameter due to insufficient input sanitization and output escaping, allowing authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Affects Plugins

Plugin icon
3d-flipbook-dflip-lite
Fixed in 2.2.27

References

CVE
CVE-2024-29807
URL
https://patchstack.com/database/vulnerability/3d-flipbook-dflip-lite/wordpress-dearflip-plugin-2-2-26-cross-site-scripting-xss-vulnerability

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
5.9 (medium)

Miscellaneous

Original Researcher
emad
Verified
No
WPVDB ID
37c4e182-0210-4e7b-b111-c437120260dc

Timeline

Publicly Published
2024-03-25 (about 2 years ago)
Added
2024-03-28 (about 2 years ago)
Last Updated
2024-03-28 (about 2 years ago)

Other

Published
Title
Published
2024-04-22
Title
myCred – Points, Rewards, Gamification, Ranks, Badges & Loyalty Plugin < 2.6.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting
Published
2026-01-05
Title
Table Field Add-on for ACF and SCF < 1.3.31 - Authenticated (Contributor+) Stored Cross-Site Scripting via Table Cell Content
Published
2021-06-21
Title
myStickymenu < 2.5.2 - Authenticated Stored XSS
Published
2024-07-09
Title
FormFlow < 2.12.2 - Admin+ Stored XSS
Published
2023-02-06
Title
Monolit < 2.0.7 - Reflected XSS