The WANotifier WordPress plugin before 2.6.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
History

No history.

cve-icon MITRE

Status: PUBLISHED

Assigner: WPScan

Published: 2024-07-31T06:00:02.242Z

Updated: 2024-07-31T13:58:59.116Z

Reserved: 2024-06-19T14:56:08.104Z

Link: CVE-2024-6165

cve-icon Vulnrichment

Updated: 2024-07-31T13:58:53.966Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2024-07-31T06:15:03.373

Modified: 2024-08-01T14:00:13.553

Link: CVE-2024-6165

cve-icon Redhat

No data.