Wp Forecast Vulnerabilities

[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Hans Matzen allows Stored XSS.This issue affects wp-forecast: from n/a through 9.2.

Affected:

up to 9.3

Fixed in:

9.3

Disclosed:

Mar 29, 2024

CVE-2024-30429 on NVD →

The wp-forecast plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 9.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that w...

CVSS:

6.4

Affected:

up to 9.2

Fixed in:

9.3

Disclosed:

Mar 28, 2024

CVE-2024-30429 on NVD →

[en] Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Hans Matzen's wp-forecast plugin <= 7.5 at WordPress.

Affected:

up to 8.0

Fixed in:

8.0

Disclosed:

Sep 9, 2022

CVE-2022-35725 on NVD →

The wp-forecast plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an unknown parameter in versions up to, and including, 7.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbit...

CVSS:

5.5

Affected:

up to 7.5

Fixed in:

8.0

Disclosed:

Aug 25, 2022

CVE-2022-35725 on NVD →