Not rated
CVE-2023-2398 The Icegram Engage WordPress plugin before 3.1.12 does not escape a parameter before outputting it back in an attribute,…
Description
The Icegram Engage WordPress plugin before 3.1.12 does not escape a parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Icegram Engage 3.1 | earliest → < 3.1.12 | 3.1.12 |
Other CVEs of Icegram Engage
The 4 CVEs of Icegram Engage →
CVE-2024-13482
The Icegram Engage WordPress plugin before 3.1.32 does not sanitise and escape some of its settings, which could…
4.8
Medium
CVE-2024-13486
The Icegram Engage WordPress plugin before 3.1.32 does not sanitise and escape some of its settings, which could…
4.8
Medium
CVE-2024-12302
The Icegram Engage WordPress plugin before 3.1.32 does not sanitise and escape some of its Campaign settings, which…
6.1
Medium