Vulnerabilities

TI-2024-08038 CVE-2024-8665 · GHSA-7fgm-q7w5-rr3c

YITH Custom Login <= 1.7.3 - Reflected Cross-Site Scripting

LOW 28

The YITH Custom Login plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.7.3.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00494 Published 2024-09-13 No fix listed CWE-79

TI-2024-23601 CVE-2024-35732 · GHSA-f9p7-j87r-6fqp

WordPress YITH Custom Login plugin <= 1.7.0 - Cross Site Scripting (XSS) vulnerability

LOW 26

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in YITHEMES YITH Custom Login yith-custom-login.This issue affects YITH Custom Login: from n/a through <= 1.7.0.

CVSS 3.1MEDIUM 5.9 Network High privileges User interaction EPSS 0.00279 Published 2024-06-08 No fix listed CWE-79

Vulnerabilities

Filters

YITH Custom Login <= 1.7.3 - Reflected Cross-Site Scripting

WordPress YITH Custom Login plugin <= 1.7.0 - Cross Site Scripting (XSS) vulnerability