Skip to content
Sign in
Not rated

CVE-2023-4284 The Post Timeline WordPress plugin before 2.2.6 does not sanitise and escape an invalid nonce before outputting it…

Description

The Post Timeline WordPress plugin before 2.2.6 does not sanitise and escape an invalid nonce before outputting it back in an AJAX response, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin

Affected products and versions

Product Affected versions Fixed in
Post Timeline 2.2 earliest → < 2.2.6 2.2.6

Other CVEs of Post Timeline

The 2 CVEs of Post Timeline →
CVE-2024-13571 The Post Timeline WordPress plugin before 2.3.10 does not sanitise and escape a parameter before outputting it back in… 7.1 High
Track this CVE