WordPress Plugin Vulnerabilities

WeSecur Security <= 1.2.1 - Admin+ Stored Cross-Site Scripting

Description

The plugin does not properly sanitize and escape user input, leading to a stored XSS vulnerability.

Affects Plugins

Plugin icon
wesecur-security
No known fix

References

CVE
CVE-2023-24390
URL
https://patchstack.com/database/vulnerability/wesecur-security/wordpress-wesecur-security-plugin-1-2-1-cross-site-scripting-xss-vulnerability

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
5.9 (medium)

Miscellaneous

Original Researcher
Prasanna V Balaji
Verified
No
WPVDB ID
8187c122-e024-4400-b8c9-11f6c5dea523

Timeline

Publicly Published
2023-05-18 (about 2 years ago)
Added
2023-07-18 (about 2 years ago)
Last Updated
2023-07-18 (about 2 years ago)

Other

Published
Title
Published
2025-01-16
Title
Jet Skinner for BuddyPress <= 1.2.5 - Reflected Cross-Site Scripting
Published
2016-07-13
Title
All in One SEO Pack <= 2.3.7 - Unauthenticated Stored Cross-Site Scripting (XSS)
Published
2024-08-16
Title
Purity Of Soul <= 1.9 - Reflected Cross-Site Scripting
Published
2017-09-26
Title
WP Jobs < 1.7 - XSS
Published
2014-08-01
Title
Meta Slider <= 2.5 - Cross-Site Scripting (XSS)