CVE Database /
CVE-2024-0625
CVE · Medium
CVE-2024-0625 — WPFront Notification Bar [wpfront-notification-bar] < 3.4
| CVE |
Vulnerability |
Type |
Severity |
Affected |
Fixed in |
Published |
Status |
|
CVE-2024-0625
|
WPFront Notification Bar [wpfront-notification-bar] < 3.4 |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') |
Medium
4.8
|
< 3.4
|
3.4 |
2024-01-24 |
—
|
CVE-2024-0625
The WPFront Notification Bar plugin contains a stored cross-site scripting flaw in the 'wpfront-notification-bar-options[custom_class]' parameter affecting versions through 3.3.2, caused by inadequate input sanitization and output encoding. Administrators can inject malicious scripts into pages that will run when users view those pages, though this vulnerability only impacts multi-site setups and installations where unfiltered_html capability is disabled. The issue was fixed in version 3.4.
Based on public CVE data (MITRE/NVD).
Scan your WordPress site free
No signup, no credit card — enter your URL and get a security report in seconds.
See the full security page for this plugin
Browse the CVE database
Browse all security findings