CVE-2024-11605

The wp-publications WordPress plugin through 1.2 does not escape filenames before outputting them back in the page, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).

Affected products

Wp-Publications

Wp-publications Project Wp-publications

≤ 1.2

Fix

Available

CVSS 3.1

4.8 MEDIUM

EPSS

1.3% (68th percentile)

Weakness

CWE-79

NVD status

Analyzed

Published

2024-12-27