Newsmash Vulnerabilities

The NewsMash theme for WordPress is vulnerable to Stored Cross-Site Scripting via a malicious display name in all versions up to, and including, 1.0.71 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbit...

CVSS:

6.4

Affected:

up to 1.0.71

Fixed in:

1.0.72

Disclosed:

Dec 5, 2024

CVE-2024-10849 on NVD →

The NewsMash theme for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.34. This is due to missing or incorrect nonce validation on the newsmash_ajax_notice_handler() function. This makes it possible for unauthenticated attackers to dismiss notices via a forged request granted...

CVSS:

4.3

Affected:

up to 1.0.34

Fixed in:

1.0.35

Disclosed:

Jun 28, 2024

CVE-2024-37441 on NVD →