Ajax Login And Registration Modal Popup Vulnerabilities

The AJAX Login and Registration modal popup + inline form plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.24. This makes it possible for unauthenticated attackers to inject arbitrary web...

CVSS:

6.1

Affected:

up to 2.24

Fixed in:

2.25

Disclosed:

Nov 12, 2024

CVE-2024-8874 on NVD →

The AJAX Login and Registration modal popup + inline form plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.23 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject...

CVSS:

6.4

Affected:

up to 2.23

Fixed in:

2.24

Disclosed:

Apr 29, 2024

CVE-2024-33918 on NVD →