Wp Custom Taxonomy Meta Vulnerabilities

[en] The Category and Taxonomy Meta Fields plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.0. This is due to missing or incorrect nonce validation on the 'wpaft_option_page' function. This makes it possible for unauthenticated attackers to add and delete taxonomy m...

Affected:

up to 1.0.0

Fix:

No patched version reported

Disclosed:

Oct 22, 2024

CVE-2024-9588 on NVD →

[en] The Category and Taxonomy Meta Fields plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the image meta field value in the 'wpaft_add_meta_textinput' function in versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping on user supplied attributes. This make...

Affected:

up to 1.0.0

Fix:

No patched version reported

Disclosed:

Oct 22, 2024

CVE-2024-9590 on NVD →

[en] The Category and Taxonomy Meta Fields plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'new_meta_name' parameter in the 'wpaft_option_page' function in versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it...

Affected:

up to 1.0.0

Fix:

No patched version reported

Disclosed:

Oct 22, 2024

CVE-2024-9589 on NVD →

The Category and Taxonomy Meta Fields plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the image meta field value in the 'wpaft_add_meta_textinput' function in versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it...

CVSS:

5.5

Affected:

up to 1.0.0

Fix:

No patched version reported

Disclosed:

Oct 21, 2024

CVE-2024-9590 on NVD →

The Category and Taxonomy Meta Fields plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'new_meta_name' parameter in the 'wpaft_option_page' function in versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it poss...

CVSS:

5.5

Affected:

up to 1.0.0

Fix:

No patched version reported

Disclosed:

Oct 21, 2024

CVE-2024-9589 on NVD →

The Category and Taxonomy Meta Fields plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.0. This is due to missing or incorrect nonce validation on the 'wpaft_option_page' function. This makes it possible for unauthenticated attackers to add and delete taxonomy meta,...

CVSS:

5.4

Affected:

up to 1.0.0

Fix:

No patched version reported

Disclosed:

Oct 21, 2024

CVE-2024-9588 on NVD →