The Post Timeline WordPress plugin before 2.3.10 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege user…
CVSS 3.1HIGH 7.1·Network·No auth·User interaction·EPSS 0.00351·Published 2025-02-26·Fixed in 2.3.10CWE-79
The Post Timeline WordPress plugin before 2.2.6 does not sanitise and escape an invalid nonce before outputting it back in an AJAX response, leading to a Reflected Cross-Site Scripting which could be used against high pr…
CVSS 3.1MEDIUM 6.1·Network·No auth·User interaction·EPSS 0.00759·Published 2023-09-04·Fixed in 2.2.6