Wp Code Highlightjs Vulnerabilities

The WP Code Highlight.js plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 0.6.2. This is due to missing or incorrect nonce validation on the hljs_settings_page() function. This makes it possible for unauthenticated attackers to inject malicious web scripts via a forged...

CVSS:

8.8

Affected:

up to 0.6.3

Fixed in:

0.6.3

Disclosed:

Jul 19, 2019

CVE-2019-12934 on NVD →

The WP Code Highlight.js plugin for WordPress is vulnerable to Cross-Site Scripting in versions up to, and including, 0.6.3 due to insufficient input sanitization and output escaping. This makes it possible for attackers to inject arbitrary web scripts that execute in a victim's browser.

CVSS:

7.1

Affected:

up to 0.6.3

Fix:

No patched version reported

Disclosed:

Jul 12, 2019