WordPress Plugin Vulnerabilities

Namaste! LMS < 2.5.9.2 - Admin+ Stored XSS

Description

The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

Affects Plugins

Plugin icon
namaste-lms
Fixed in 2.5.9.2

References

CVE
CVE-2023-24383

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
3.5 (low)

Miscellaneous

Original Researcher
yuyudhn
Verified
No
WPVDB ID
c4cda513-3b69-4fd5-9c36-9a88c122f37a

Timeline

Publicly Published
2023-01-27 (about 3 years ago)
Added
2023-04-06 (about 2 years ago)
Last Updated
2023-04-06 (about 2 years ago)

Other

Published
Title
Published
2025-05-02
Title
Personizely < 0.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via widgetId Parameter
Published
2025-06-27
Title
HT Slider For Elementor < 1.6.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2022-08-17
Title
Autoptimize < 3.1.1 - Admin+ Stored Cross Site Scripting
Published
2023-12-28
Title
Product Enquiry for WooCommerce < 3.1 - Admin+ Stored XSS
Published
2023-01-03
Title
Survey Maker < 3.1.4 - Unauthenticated Stored XSS