WordPress Plugin Vulnerabilities

Greek Multi Tool < 2.3.2 - Unauthenticated Stored XSS

Description

The plugin is vulnerable to Stored Cross-Site Scripting via the 'record_newPermalinkValue' parameter due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Affects Plugins

Plugin icon
greek-multi-tool
Fixed in 2.3.2

References

URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/33f17152-f273-46d0-ad37-55953adee919

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
8.8 (high)

Miscellaneous

Verified
No
WPVDB ID
aba918ee-b2a4-49a5-8ede-aa1bcbeccbe1

Timeline

Publicly Published
2025-03-05 (about 1 year ago)
Added
2025-05-05 (about 1 year ago)
Last Updated
2025-05-05 (about 1 year ago)

Other

Published
Title
Published
2026-01-23
Title
Postalicious <= 3.0.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin Settings
Published
2024-02-26
Title
Grid Shortcodes < 1.1.1 - Contributor+ Stored XSS
Published
2025-01-06
Title
WP FullCalendar < 1.6 - Contributor+ Stored XSS
Published
2024-01-23
Title
illi Link Party! <= 1.0 - Unauthenticated Stored XSS
Published
2025-01-07
Title
AddFunc Mobile Detect <= 3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting