plugin

Light Messages Vulnerabilities

1 known security issue reported for the Light Messages WordPress plugin. Most recent disclosed Jul 19, 2021.

1 medium

Running Light Messages on your site? Check whether your installed version is affected.

Scan your site free

Light Messages <= 1.0 - Authenticated (Admin+) Cross-Site Scripting

medium

The Light Messages WordPress plugin through 1.0 is lacking CSRF check when updating it's settings, and is not sanitising its Message Content in them (even with the unfiltered_html disallowed). As a result, an attacker could make a logged in admin update the settings to arbitrary values, and set a Cross-Site Scripting p...

CVSS:
6.1
Affected:
up to 1.0
Fix:
No patched version reported
Disclosed:
Jul 19, 2021

CVE-2021-24535 on NVD →

Protect your WordPress site

Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.

Scan your site free

← Back to the vulnerability database