Plugin Notes Plus Vulnerabilities

[en] Missing Authorization vulnerability in Jamie Bergen Plugin Notes Plus allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Plugin Notes Plus: from n/a through 1.2.7.

Affected:

up to 1.2.8

Fixed in:

1.2.8

Disclosed:

Aug 19, 2024

CVE-2024-43326 on NVD →

The Plugin Notes Plus plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the pnp_delete_response() function in all versions up to, and including, 1.2.7. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitra...

CVSS:

4.3

Affected:

up to 1.2.7

Fixed in:

1.2.8

Disclosed:

Aug 16, 2024

CVE-2024-43326 on NVD →

[en] Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Jamie Bergen Plugin Notes Plus allows Stored XSS.This issue affects Plugin Notes Plus: from n/a through 1.2.6.

Affected:

up to 1.2.7

Fixed in:

1.2.7

Disclosed:

Jul 20, 2024

CVE-2024-37561 on NVD →

The Plugin Notes Plus plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.2.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access and above, to inject arbitrary web scripts in pa...

CVSS:

4.4

Affected:

up to 1.2.6

Fixed in:

1.2.7

Disclosed:

Jul 9, 2024

CVE-2024-37561 on NVD →