Skip to content
Sign in
4.8 Medium

CVE-2024-10632 The Nokaut Offers Box WordPress plugin through 1.4.0 does not sanitize and escape some of its settings, which could…

Description

The Nokaut Offers Box WordPress plugin through 1.4.0 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

Affected products and versions

Product Affected versions Fixed in
Nokaut Offers Box 1.4 earliest → 1.4.0 No fix stated

Other CVEs of Nokaut Offers Box

The 2 CVEs of Nokaut Offers Box →
CVE-2024-10634 The Nokaut Offers Box WordPress plugin through 1.4.0 does not have CSRF check in place when updating its settings, which… 4.3 Medium
Track this CVE