CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 0CVE-2024-29819 – WordPress WPFront Notification Bar plugin <= 3.3.2 - Cross Site Scripting (XSS) vulnerability
https://notcve.org/view.php?id=CVE-2024-29819
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Syam Mohan WPFront Notification Bar allows Stored XSS.This issue affects WPFront Notification Bar: from n/a through 3.3.2. La vulnerabilidad de neutralización inadecuada de la entrada durante la generación de páginas web ('cross-site Scripting') en la barra de notificaciones de WPFront de Syam Mohan permite almacenar XSS. Este problema afecta a la barra de notificaciones de WPFront: desde n/a hasta 3.3.2. The WPFront Notification Bar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via settings in all versions up to, and including, 3.3.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with editor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. • https://patchstack.com/database/vulnerability/wpfront-notification-bar/wordpress-wpfront-notification-bar-plugin-3-3-2-cross-site-scripting-xss-vulnerability?_s_id=cve • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.8EPSS: 0%CPEs: 1EXPL: 0CVE-2024-0625 – WPFront Notification Bar <= 3.3.2 - Authenticated (Admin+) Stored Cross-Site Scripting via wpfront-notification-bar-options[custom_class]
https://notcve.org/view.php?id=CVE-2024-0625
The WPFront Notification Bar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘wpfront-notification-bar-options[custom_class]’ parameter in all versions up to, and including, 3.3.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. El complemento WPFront Notification Bar para WordPress es vulnerable a Cross-Site Scripting Almacenado a través del parámetro 'wpfront-notification-bar-options[custom_class]' en todas las versiones hasta la 3.3.2 incluida debido a una sanitización de entrada insuficiente y un escape de salida . Esto hace posible que atacantes autenticados, con acceso a nivel de administrador, inyecten scripts web arbitrarios en páginas que se ejecutarán cada vez que un usuario acceda a una página inyectada. • https://plugins.trac.wordpress.org/browser/wpfront-notification-bar/trunk/templates/template-wpfront-notification-bar.php#L94 https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3025472%40wpfront-notification-bar&new=3025472%40wpfront-notification-bar&sfp_email=&sfph_mail= https://www.wordfence.com/threat-intel/vulnerabilities/id/19a5a9f3-637c-42af-9775-5651a14cf516?source=cve • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 1CVE-2021-24601 – WPFront Notification Bar < 2.1.0.08087 - Authenticated Stored XSS
https://notcve.org/view.php?id=CVE-2021-24601
The WPFront Notification Bar WordPress plugin before 2.1.0.08087 does not properly sanitise and escape its settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed. El plugin de WordPress WPFront Notification Bar versiones anteriores a 2.1.0.08087, no sanea ni escapa apropiadamente de su configuración, lo que podría permitir a usuarios con altos privilegios realizar ataques de tipo Cross-Site Scripting incluso cuando la capacidad unfiltered_html no está permitida. • https://wpscan.com/vulnerability/bb437706-a918-4d66-b027-b083ab486074 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •