Norse Runes Oracle Vulnerabilities

The Norse Rune Oracle Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.4.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts...

CVSS:

6.4

Affected:

up to 1.4.3

Fixed in:

1.4.4

Disclosed:

Apr 1, 2025

CVE-2025-31884 on NVD →

[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP CMS Ninja Norse Rune Oracle Plugin allows Stored XSS. This issue affects Norse Rune Oracle Plugin: from n/a through 1.4.3.

Affected:

up to 1.4.4

Fixed in:

1.4.4

Disclosed:

Apr 1, 2025

CVE-2025-31884 on NVD →

The Norse Rune Oracle Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.2. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a fo...

CVSS:

6.1

Affected:

up to 1.4.2

Fixed in:

1.4.3

Disclosed:

Jan 7, 2025

CVE-2025-22556 on NVD →

[en] Cross-Site Request Forgery (CSRF) vulnerability in Greg Whitehead Norse Rune Oracle Plugin allows Cross Site Request Forgery.This issue affects Norse Rune Oracle Plugin: from n/a through 1.4.1.

Affected:

up to 1.4.3

Fixed in:

1.4.3

Disclosed:

Jan 7, 2025

CVE-2025-22556 on NVD →