Pocket News Generator Vulnerabilities

[en] The Pocket News Generator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings such as "Consumer Key" and "Access Token" in all versions up to, and including, 0.2.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with a...

Affected:

up to 0.2.0

Fix:

No patched version reported

Disclosed:

Mar 29, 2024

CVE-2024-2963 on NVD →

[en] The Pocket News Generator plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.2.0. This is due to missing or incorrect nonce validation on the option_page() function. This makes it possible for unauthenticated attackers to update the plugin's settings via a forg...

Affected:

up to 0.2.0

Fix:

No patched version reported

Disclosed:

Mar 29, 2024

CVE-2024-2964 on NVD →

The Pocket News Generator plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.2.0. This is due to missing or incorrect nonce validation on the option_page() function. This makes it possible for unauthenticated attackers to update the plugin's settings via a forged re...

CVSS:

5.4

Affected:

up to 0.2.0

Fix:

No patched version reported

Disclosed:

Mar 28, 2024

CVE-2024-2964 on NVD →

The Pocket News Generator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings such as "Consumer Key" and "Access Token" in all versions up to, and including, 0.2.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with admini...

CVSS:

4.4

Affected:

up to 0.2.0

Fix:

No patched version reported

Disclosed:

Mar 28, 2024

CVE-2024-2963 on NVD →