WP-BibTeX [wp-bibtex] <= 3.0.1 (unfixed + closed)
unknown
[en] The WP-BibTeX plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'WpBibTeX' shortcode in all versions up to, and including, 3.0.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contribu...
- Affected:
- up to 3.0.1
- Fix:
- No patched version reported
- Disclosed:
- Feb 18, 2025
CVE-2024-13578 on NVD →
WP-BibTeX <= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
medium
The WP-BibTeX plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'WpBibTeX' shortcode in all versions up to, and including, 3.0.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-l...
- CVSS:
- 6.4
- Affected:
- up to 3.0.1
- Fix:
- No patched version reported
- Disclosed:
- Feb 17, 2025
CVE-2024-13578 on NVD →
WP-BibTeX [wp-bibtex] < 3.0.2 (closed)
unknown
[en] The WP-BibTeX plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.0.1. This is due to missing or incorrect nonce validation on the wp_bibtex_option_page() function. This makes it possible for unauthenticated attackers to inject malicious web scripts via a forged...
- Affected:
- up to 3.0.2
- Fixed in:
- 3.0.2
- Disclosed:
- Jan 21, 2025
CVE-2024-12005 on NVD →
WP-BibTeX <= 3.0.1 - Cross-Site Request Forgery to Stored and Reflected Cross-Site Scripting
medium
The WP-BibTeX plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.0.1. This is due to missing or incorrect nonce validation on the wp_bibtex_option_page() function. This makes it possible for unauthenticated attackers to inject malicious web scripts via a forged requ...
- CVSS:
- 6.1
- Affected:
- up to 3.0.1
- Fixed in:
- 3.0.2
- Disclosed:
- Jan 20, 2025
CVE-2024-12005 on NVD →
Protect your WordPress site
Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.
Scan your site free
← Back to the vulnerability database