Wp Timelines Vulnerabilities

[en] Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Ex-Themes WP Timeline – Vertical and Horizontal timeline plugin allows Reflected XSS.This issue affects WP Timeline – Vertical and Horizontal timeline plugin: from n/a through 3.6.7.

Affected:

up to 3.6.8

Fixed in:

3.6.8

Disclosed:

Oct 6, 2024

CVE-2024-47322 on NVD →

[en] Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Ex-Themes WP Timeline – Vertical and Horizontal timeline plugin allows PHP Local File Inclusion.This issue affects WP Timeline – Vertical and Horizontal timeline plugin: from n/a through 3.6.7.

Affected:

up to 3.6.8

Fixed in:

3.6.8

Disclosed:

Oct 5, 2024

CVE-2024-47324 on NVD →

[en] Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Ex-Themes WP Timeline – Vertical and Horizontal timeline plugin allows PHP Local File Inclusion.This issue affects WP Timeline – Vertical and Horizontal timeline plugin: from n/a through 3.6.7.

Affected:

up to 3.6.8

Fixed in:

3.6.8

Disclosed:

Oct 5, 2024

CVE-2024-47323 on NVD →

The WP Timeline – Vertical and Horizontal timeline plugin plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.6.7. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those fil...

CVSS:

9.8

Affected:

up to 3.6.7

Fixed in:

3.6.8

Disclosed:

Sep 25, 2024

CVE-2024-47323 on NVD →

The wp-timelines plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.6.7. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those file...

CVSS:

8.8

Affected:

up to 3.6.7

Fixed in:

3.6.8

Disclosed:

Sep 25, 2024

CVE-2024-47324 on NVD →

The WP Timeline – Vertical and Horizontal timeline plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 3.6.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages...

CVSS:

6.1

Affected:

up to 3.6.7

Fixed in:

3.6.8

Disclosed:

Sep 25, 2024

CVE-2024-47322 on NVD →