Filtered by vendor Ngothang Subscriptions
Filtered by product Wp Multitasking Subscriptions
Total 6 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2024-8189 1 Ngothang 1 Wp Multitasking 2024-10-07 4.4 Medium
The WP MultiTasking – WP Utilities plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘wpmt_menu_name’ parameter in all versions up to, and including, 0.1.17 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
CVE-2024-6852 2 Ngothang, Thangnv27 2 Wp Multitasking, Wp Multitasking 2024-09-11 6.5 Medium
The WP MultiTasking WordPress plugin through 0.1.12 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
CVE-2024-6853 2 Ngothang, Thangnv27 2 Wp Multitasking, Wp Multitasking 2024-09-11 6.5 Medium
The WP MultiTasking WordPress plugin through 0.1.12 does not have CSRF check when updating welcome popups, which could allow attackers to make logged admins perform such action via a CSRF attack
CVE-2024-6855 2 Ngothang, Thangnv27 2 Wp Multitasking, Wp Multitasking 2024-09-11 6.5 Medium
The WP MultiTasking WordPress plugin through 0.1.12 does not have CSRF check when updating exit popups, which could allow attackers to make logged admins perform such action via a CSRF attack
CVE-2024-6856 2 Ngothang, Thangnv27 2 Wp Multitasking, Wp Multitasking 2024-09-11 6.5 Medium
The WP MultiTasking WordPress plugin through 0.1.12 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
CVE-2024-6859 2 Ngothang, Thangnv27 2 Wp Multitasking, Wp Multitasking 2024-09-11 5.4 Medium
The WP MultiTasking WordPress plugin through 0.1.12 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks