Wp Multitasking Vulnerabilities

The WP MultiTasking – WP Utilities plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.1.12. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to update the Header/Footer/Body Script via a forged...

CVSS:

4.3

Affected:

up to 0.1.12

Fix:

No patched version reported

Disclosed:

Mar 19, 2025

CVE-2024-6857 on NVD →

The WP MultiTasking – WP Utilities plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.1.12. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to update the permalink suffix via a forged request g...

CVSS:

4.3

Affected:

up to 0.1.12

Fix:

No patched version reported

Disclosed:

Mar 19, 2025

CVE-2024-6860 on NVD →

[en] The WP MultiTasking – WP Utilities plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘wpmt_menu_name’ parameter in all versions up to, and including, 0.1.17 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-lev...

Affected:

up to 0.1.18

Fixed in:

0.1.18

Disclosed:

Sep 28, 2024

CVE-2024-8189 on NVD →

The WP MultiTasking – WP Utilities plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘wpmt_menu_name’ parameter in all versions up to, and including, 0.1.17 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level ac...

CVSS:

4.4

Affected:

up to 0.1.17

Fixed in:

0.1.18

Disclosed:

Sep 27, 2024

CVE-2024-8189 on NVD →

[en] The WP MultiTasking WordPress plugin through 0.1.12 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack

Affected:

up to 0.1.12

Fix:

No patched version reported

Disclosed:

Sep 8, 2024

CVE-2024-6856 on NVD →

[en] The WP MultiTasking WordPress plugin through 0.1.12 does not have CSRF check when updating exit popups, which could allow attackers to make logged admins perform such action via a CSRF attack

Affected:

up to 0.1.12

Fix:

No patched version reported

Disclosed:

Sep 8, 2024

CVE-2024-6855 on NVD →

[en] The WP MultiTasking WordPress plugin through 0.1.12 does not have CSRF check when updating welcome popups, which could allow attackers to make logged admins perform such action via a CSRF attack

Affected:

up to 0.1.12

Fix:

No patched version reported

Disclosed:

Sep 8, 2024

CVE-2024-6853 on NVD →

[en] The WP MultiTasking WordPress plugin through 0.1.12 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack

Affected:

up to 0.1.12

Fix:

No patched version reported

Disclosed:

Sep 8, 2024

CVE-2024-6852 on NVD →

[en] The WP MultiTasking WordPress plugin through 0.1.12 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks

Affected:

up to 0.1.12

Fix:

No patched version reported

Disclosed:

Sep 8, 2024

CVE-2024-6859 on NVD →

The WP MultiTasking – WP Utilities plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in all versions up to, and including, 0.1.12 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if t...

CVSS:

6.1

Affected:

up to 0.1.12

Fix:

No patched version reported

Disclosed:

Aug 10, 2024

CVE-2024-6859 on NVD →

The WP MultiTasking – WP Utilities plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.1.12. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to update the plugin's settings via a forged request...

CVSS:

4.3

Affected:

up to 0.1.12

Fix:

No patched version reported

Disclosed:

Aug 10, 2024

CVE-2024-6852 on NVD →

The WP MultiTasking – WP Utilities plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.1.12. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to update the exit popup via a forged request granted...

CVSS:

4.3

Affected:

up to 0.1.12

Fix:

No patched version reported

Disclosed:

Aug 10, 2024

CVE-2024-6855 on NVD →

The WP MultiTasking – WP Utilities plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.1.12. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to update the SMTP settings via a forged request gran...

CVSS:

4.3

Affected:

up to 0.1.12

Fix:

No patched version reported

Disclosed:

Aug 10, 2024

CVE-2024-6856 on NVD →

The WP MultiTasking – WP Utilities plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.1.12. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to update the welcome popup via a forged request gran...

CVSS:

4.3

Affected:

up to 0.1.12

Fix:

No patched version reported

Disclosed:

Aug 10, 2024

CVE-2024-6853 on NVD →

Affected:

up to 0.1.12

Fix:

No patched version reported

CVE-2024-6860 on NVD →

Affected:

up to 0.1.12

Fix:

No patched version reported

CVE-2024-6857 on NVD →