White Label Cms Vulnerabilities

The White Label CMS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.7.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject...

CVSS:

4.4

Affected:

up to 2.7.12

Fixed in:

2.7.13

Disclosed:

Jul 10, 2026

CVE-2026-11898 on NVD →

[en] Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in videousermanuals.Com White Label CMS allows Reflected XSS.This issue affects White Label CMS: from n/a through 2.7.4.

Affected:

up to 2.7.5

Fixed in:

2.7.5

Disclosed:

Aug 18, 2024

CVE-2024-43303 on NVD →

The White Label CMS plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 2.7.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully...

CVSS:

6.1

Affected:

up to 2.7.4

Fixed in:

2.7.5

Disclosed:

Aug 16, 2024

CVE-2024-43303 on NVD →

[en] The White Label CMS plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the reset_plugin function in all versions up to, and including, 2.7.3. This makes it possible for unauthenticated attackers to reset plugin settings.

Affected:

up to 2.7.4

Fixed in:

2.7.4

Disclosed:

May 10, 2024

CVE-2024-4280 on NVD →

The White Label CMS plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the reset_plugin function in all versions up to, and including, 2.7.3. This makes it possible for unauthenticated attackers to reset plugin settings.

CVSS:

5.3

Affected:

up to 2.7.3

Fixed in:

2.7.4

Disclosed:

May 9, 2024

CVE-2024-4280 on NVD →

[en] The White Label CMS WordPress plugin before 2.5 unserializes user input provided via the settings, which could allow high-privilege users such as admin to perform PHP Object Injection when a suitable gadget is present.

Affected:

up to 2.5

Fixed in:

2.5

Disclosed:

Jan 2, 2023

CVE-2022-4302 on NVD →

The White Label CMS plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 2.4 via deserialization of untrusted input in the legacy_import function. This allows administrator-level attackers to inject a PHP Object. No POP chain is present in the vulnerable plugin. If a POP chain is...

CVSS:

7.2

Affected:

up to 2.4

Fixed in:

2.5

Disclosed:

Dec 8, 2022

CVE-2022-4302 on NVD →

[en] The White Label CMS WordPress plugin before 2.2.9 does not sanitise and validate the wlcms[_login_custom_js] parameter before outputting it back in the response while previewing, leading to a Reflected Cross-Site Scripting issue

Affected:

up to 2.2.9

Fixed in:

2.2.9

Disclosed:

Mar 7, 2022

CVE-2022-0422 on NVD →

The White Label CMS WordPress plugin before 2.2.9 does not sanitise and validate the wlcms[_login_custom_js] parameter before outputting it back in the response while previewing, leading to a Reflected Cross-Site Scripting issue

CVSS:

6.1

Affected:

up to 2.2.9

Fixed in:

2.2.9

Disclosed:

Feb 7, 2022

CVE-2022-0422 on NVD →

Because of this vulnerability, the attackers can inject arbitrary JavaScript or HTML code. Update the plugin.

Affected:

up to 1.5.3

Fixed in:

1.5.3

Disclosed:

May 15, 2015

The White Label CMS plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.5.2. This is due to missing or incorrect nonce validation on the 'wlcmsImport' function. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execut...

CVSS:

4.7

Affected:

up to 1.5.3

Fixed in:

1.5.3

Disclosed:

Apr 29, 2015

The White Label CMS plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.5.2. This is due to missing or incorrect nonce validation on the 'wlcmsImport' function. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execut...

Affected:

up to 1.5.3

Fixed in:

1.5.3

Disclosed:

Apr 29, 2015

[en] Cross-site request forgery (CSRF) vulnerability in wlcms-plugin.php in the White Label CMS plugin before 1.5.1 for WordPress allows remote attackers to hijack the authentication of administrators for requests that modify the developer name via the wlcms_o_developer_name parameter in a save action to wp-admin/admin...

Affected:

up to 1.5.1

Fixed in:

1.5.1

Disclosed:

Oct 24, 2012

CVE-2012-5387 on NVD →

[en] Cross-site scripting (XSS) vulnerability in wlcms-plugin.php in the White Label CMS plugin 1.5 for WordPress allows remote authenticated administrators to inject arbitrary web script or HTML via the wlcms_o_developer_name parameter in a save action to wp-admin/admin.php, a related issue to CVE-2012-5387.

Affected:

up to 1.5.1

Fixed in:

1.5.1

Disclosed:

Oct 24, 2012

CVE-2012-5388 on NVD →

Cross-site scripting (XSS) vulnerability in wlcms-plugin.php in the White Label CMS plugin 1.5 for WordPress allows remote authenticated administrators to inject arbitrary web script or HTML via the wlcms_o_developer_name parameter in a save action to wp-admin/admin.php, a related issue to CVE-2012-5387.

CVSS:

7.1

Affected:

up to 1.5.1

Fixed in:

1.5.1

Disclosed:

Oct 21, 2012

CVE-2012-5388 on NVD →

Cross-site request forgery (CSRF) vulnerability in wlcms-plugin.php in the White Label CMS plugin before 1.5.1 for WordPress allows remote attackers to hijack the authentication of administrators for requests that modify the developer name via the wlcms_o_developer_name parameter in a save action to wp-admin/admin.php,...

CVSS:

7.1

Affected:

up to 1.5.1

Fixed in:

1.5.1

Disclosed:

Oct 21, 2012

CVE-2012-5387 on NVD →

Due to a lack of CSRF protection, and lack of sanitation of user input, it is possible to trigger a Persistent XSS attack via a CSRF attack. This attack targets in particular the Import functionality, which is located in the 'wlcmsImport' function, within the file '/white-label-cms/wlcms-plugin.php'...

Affected:

up to 1.5.3

Fixed in:

1.5.3