CVE-2024-11605: WP Publications <= 1.2 - Admin+ Stored XSS
The wp-publications WordPress plugin through 1.2 does not escape filenames before outputting them back in the page, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed (for example in multisite setup).
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-11605?
CVE-2024-11605 is considered a high severity vulnerability as it allows for Stored Cross-Site Scripting attacks.
How do I fix CVE-2024-11605?
To fix CVE-2024-11605, update the wp-publications plugin to version 1.3 or later where the vulnerability has been addressed.
Who is affected by CVE-2024-11605?
CVE-2024-11605 affects users of the wp-publications WordPress plugin version 1.2 and below.
What type of attack does CVE-2024-11605 enable?
CVE-2024-11605 enables Stored Cross-Site Scripting attacks by mis-managing the output of filenames.
Can all user roles exploit CVE-2024-11605?
No, only high privilege users such as administrators can exploit CVE-2024-11605 due to the nature of the vulnerability.