Linear Vulnerabilities

[en] The Linear plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.8.1. This is due to missing or incorrect nonce validation on the 'linear-debug'. This makes it possible for unauthenticated attackers to reset the plugin's cache via a forged request granted they can...

Affected:

up to 2.8.1

Fix:

No patched version reported

Disclosed:

Jan 25, 2025

CVE-2024-13709 on NVD →

The Linear plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.8.1. This is due to missing or incorrect nonce validation on the 'linear-debug'. This makes it possible for unauthenticated attackers to reset the plugin's cache via a forged request granted they can tric...

CVSS:

4.3

Affected:

up to 2.8.1

Fixed in:

2.8.2

Disclosed:

Jan 24, 2025

CVE-2024-13709 on NVD →

[en] The Linear plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'linear_block_buy_commissions' shortcode in all versions up to, and including, 2.7.12 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attack...

Affected:

up to 2.7.12

Fix:

No patched version reported

Disclosed:

Jan 9, 2025

CVE-2024-12496 on NVD →

The Linear plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'linear_block_buy_commissions' shortcode in all versions up to, and including, 2.7.12 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers,...

CVSS:

6.4

Affected:

up to 2.7.12

Fixed in:

2.8.0

Disclosed:

Jan 8, 2025

CVE-2024-12496 on NVD →

[en] Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Linear Oy Linear linear allows DOM-Based XSS.This issue affects Linear: from n/a through 2.7.11.

Affected:

up to 2.8.1

Fixed in:

2.8.1

Disclosed:

Nov 18, 2024

CVE-2024-52426 on NVD →

The Linear plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.8.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will...

CVSS:

6.4

Affected:

up to 2.8.0

Fixed in:

2.8.1

Disclosed:

Nov 13, 2024

CVE-2024-52426 on NVD →