Skip to content
Sign in
6.1 Medium

CVE-2024-6020 The Sign-up Sheets WordPress plugin before 2.2.13 does not escape some generated URLs, as well as the…

Description

The Sign-up Sheets WordPress plugin before 2.2.13 does not escape some generated URLs, as well as the $_SERVER['REQUEST_URI'] parameter before outputting them back in attributes, which could lead to Reflected Cross-Site Scripting.

Affected products and versions

Product Affected versions Fixed in
Sign-up Sheets 2.2 earliest → < 2.2.13 2.2.13
sign-up_sheets 2.2 earliest → < 2.2.13 2.2.13

Other CVEs of Sign-up Sheets

The 4 CVEs of Sign-up Sheets →
CVE-2026-92410 The Sign-up Sheets WordPress plugin before 2.4.0 does not properly validate the CSRF nonce that protects its sign-up… 4.3 Medium CVE-2021-24441 The Sign-up Sheets WordPress plugin before 1.0.14 does not not sanitise or validate the Sheet title when generating… Not rated CVE-2021-24440 The Sign-up Sheets WordPress plugin before 1.0.14 did not sanitise or escape some of its fields when creating a new… Not rated
Track this CVE