Posterity Vulnerabilities

[en] Cross-Site Request Forgery (CSRF) vulnerability in SKT Themes Posterity allows Cross Site Request Forgery.This issue affects Posterity: from n/a through 3.3.

Affected:

up to 3.4

Fixed in:

3.4

Disclosed:

Jan 2, 2025

CVE-2024-37493 on NVD →

[en] Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in sonalsinha21 Posterity allows Stored XSS.This issue affects Posterity: from n/a through 3.6.

Affected:

up to 3.6

Fix:

No patched version reported

Disclosed:

Sep 17, 2024

CVE-2024-43995 on NVD →

The Posterity theme for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will...

CVSS:

6.4

Affected:

up to 3.8

Fix:

No patched version reported

Disclosed:

Aug 29, 2024

CVE-2024-43995 on NVD →

The Posterity theme for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.3. This is due to missing or incorrect nonce validation on the posterity_disable_ajax_notice() function. This makes it possible for unauthenticated attackers to dismiss notices via a forged request granted...

CVSS:

4.3

Affected:

up to 3.3

Fixed in:

3.4

Disclosed:

Jul 4, 2024

CVE-2024-37493 on NVD →