medium4.8Public exploit code
CVE-2024-11605
The wp-publications WordPress plugin through 1.2 does not escape filenames before outputting them back in the page, which could allow high privilege users such…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- WP Publications WordPress Plugin 1.2 - Stored XSS2025-07-16 · webapps · multiple
Impact
The wp-publications WordPress plugin through 1.2 does not escape filenames before outputting them back in the page, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Wp-Publications Project | Wp-Publications | through 1.2 |