plugin

Wp Bibtex Vulnerabilities

4 known security issues reported for the Wp Bibtex WordPress plugin. Most recent disclosed Feb 18, 2025.

2 medium

Running Wp Bibtex on your site? Check whether your installed version is affected.

Scan your site free

WP-BibTeX [wp-bibtex] <= 3.0.1 (unfixed + closed)

unknown

[en] The WP-BibTeX plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'WpBibTeX' shortcode in all versions up to, and including, 3.0.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contribu...

Affected:
up to 3.0.1
Fix:
No patched version reported
Disclosed:
Feb 18, 2025

CVE-2024-13578 on NVD →

WP-BibTeX <= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

medium

The WP-BibTeX plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'WpBibTeX' shortcode in all versions up to, and including, 3.0.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-l...

CVSS:
6.4
Affected:
up to 3.0.1
Fix:
No patched version reported
Disclosed:
Feb 17, 2025

CVE-2024-13578 on NVD →

WP-BibTeX [wp-bibtex] < 3.0.2 (closed)

unknown

[en] The WP-BibTeX plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.0.1. This is due to missing or incorrect nonce validation on the wp_bibtex_option_page() function. This makes it possible for unauthenticated attackers to inject malicious web scripts via a forged...

Affected:
up to 3.0.2
Fixed in:
3.0.2
Disclosed:
Jan 21, 2025

CVE-2024-12005 on NVD →

WP-BibTeX <= 3.0.1 - Cross-Site Request Forgery to Stored and Reflected Cross-Site Scripting

medium

The WP-BibTeX plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.0.1. This is due to missing or incorrect nonce validation on the wp_bibtex_option_page() function. This makes it possible for unauthenticated attackers to inject malicious web scripts via a forged requ...

CVSS:
6.1
Affected:
up to 3.0.1
Fixed in:
3.0.2
Disclosed:
Jan 20, 2025

CVE-2024-12005 on NVD →

Protect your WordPress site

Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.

Scan your site free

← Back to the vulnerability database