Wp Webauthn Vulnerabilities

[en] The WP-WebAuthn plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting via the `wwa_auth` AJAX endpoint in all versions up to, and including, 1.3.4 due to insufficient input sanitization and output escaping on user supplied attributes logged by the plugin. This makes it possible for unau...

Affected:

up to 1.3.4

Fix:

No patched version reported

Disclosed:

Mar 21, 2026

CVE-2025-13910 on NVD →

The WP-WebAuthn plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting via the `wwa_auth` AJAX endpoint in all versions up to, and including, 1.3.4 due to insufficient input sanitization and output escaping on user supplied attributes logged by the plugin. This makes it possible for unauthent...

CVSS:

6.1

Affected:

up to 1.3.4

Fix:

No patched version reported

Disclosed:

Mar 20, 2026

CVE-2025-13910 on NVD →

[en] Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Axton WP-WebAuthn allows Stored XSS.This issue affects WP-WebAuthn: from n/a through 1.3.1.

Affected:

up to 1.3.2

Fixed in:

1.3.2

Disclosed:

Oct 6, 2024

CVE-2024-47650 on NVD →

The WP-WebAuthn plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.3.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that...

CVSS:

6.4

Affected:

up to 1.3.1

Fixed in:

1.3.2

Disclosed:

Sep 30, 2024

CVE-2024-47650 on NVD →

[en] The WP-WebAuthn plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wwa_login_form shortcode in all versions up to, and including, 1.3.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with co...

Affected:

up to 1.3.4

Fixed in:

1.3.4

Disclosed:

Sep 28, 2024

CVE-2024-9023 on NVD →

The WP-WebAuthn plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wwa_login_form shortcode in all versions up to, and including, 1.3.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contrib...

CVSS:

6.4

Affected:

up to 1.3.3

Fixed in:

1.3.4

Disclosed:

Sep 27, 2024

CVE-2024-9023 on NVD →