Remove Footer Credit Vulnerabilities

The Remove Footer Credit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.0.13 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to in...

CVSS:

4.4

Affected:

up to 1.0.13

Fixed in:

1.0.14

Disclosed:

Apr 12, 2024

CVE-2024-32429 on NVD →

The Remove Footer Credit WordPress plugin before 1.0.11 does properly sanitise its settings, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed.

CVSS:

4.8

Affected:

up to 1.0.10

Fixed in:

1.0.11

Disclosed:

Jan 12, 2022

CVE-2021-25050 on NVD →

The Remove Footer Credit WordPress plugin before 1.0.6 does not have CSRF check in place when saving its settings, which could allow attacker to make logged in admins change them and lead to Stored XSS issue as well due to the lack of sanitisation

CVSS:

6.1

Affected:

up to 1.0.5

Fixed in:

1.0.6

Disclosed:

Jul 12, 2021

CVE-2021-24446 on NVD →