Publish Advisories

GHSA-4fc7-954j-99v4
GHSA-9cjm-fv5h-54p6
GHSA-c846-2c33-mpmm
GHSA-qgc3-2f6v-85jf

advisories/unreviewed/2025/04/GHSA-4fc7-954j-99v4/GHSA-4fc7-954j-99v4.json

@@ -0,0 +1,44 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-4fc7-954j-99v4",
+  "modified": "2025-04-09T06:30:25Z",
+  "published": "2025-04-09T06:30:25Z",
+  "aliases": [
+    "CVE-2025-3100"
+  ],
+  "details": "The WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 2.6.22 due to insufficient input sanitization and output escaping in tasks discussion. This makes it possible for authenticated attackers, with Subscriber-level access and above, and permissions granted by an Administrator, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3100"
+    },
+    {
+      "type": "WEB",
+      "url": "https://plugins.trac.wordpress.org/browser/wedevs-project-manager/trunk/src/File/Helper/File.php#L56"
+    },
+    {
+      "type": "WEB",
+      "url": "https://plugins.trac.wordpress.org/changeset/3268509/wedevs-project-manager/trunk/bootstrap/loaders.php"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4d62b087-b0ca-4fa8-921b-5eeb3fa76596?source=cve"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-79"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-04-09T05:15:43Z"
+  }
+}

advisories/unreviewed/2025/04/GHSA-9cjm-fv5h-54p6/GHSA-9cjm-fv5h-54p6.json

@@ -0,0 +1,29 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-9cjm-fv5h-54p6",
+  "modified": "2025-04-09T06:30:25Z",
+  "published": "2025-04-09T06:30:25Z",
+  "aliases": [
+    "CVE-2024-6857"
+  ],
+  "details": "The WP MultiTasking  WordPress plugin through 0.1.12 does not have CSRF check when updating its Header, Footer and Body Script Settings, which could allow attackers to make logged admins perform such action via a CSRF attack",
+  "severity": [],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6857"
+    },
+    {
+      "type": "WEB",
+      "url": "https://wpscan.com/vulnerability/97636602-2dd0-465b-b6dc-acb42147edb3"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-04-09T06:15:39Z"
+  }
+}

advisories/unreviewed/2025/04/GHSA-c846-2c33-mpmm/GHSA-c846-2c33-mpmm.json

@@ -0,0 +1,29 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-c846-2c33-mpmm",
+  "modified": "2025-04-09T06:30:25Z",
+  "published": "2025-04-09T06:30:25Z",
+  "aliases": [
+    "CVE-2024-8243"
+  ],
+  "details": "The WordPress/Plugin Upgrade Time Out Plugin WordPress plugin through 1.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.",
+  "severity": [],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-8243"
+    },
+    {
+      "type": "WEB",
+      "url": "https://wpscan.com/vulnerability/8e1e2d8d-41aa-49bc-95d5-dae75be788d5"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-04-09T06:15:41Z"
+  }
+}

advisories/unreviewed/2025/04/GHSA-qgc3-2f6v-85jf/GHSA-qgc3-2f6v-85jf.json

@@ -0,0 +1,29 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-qgc3-2f6v-85jf",
+  "modified": "2025-04-09T06:30:25Z",
+  "published": "2025-04-09T06:30:25Z",
+  "aliases": [
+    "CVE-2024-6860"
+  ],
+  "details": "The WP MultiTasking  WordPress plugin through 0.1.12 does not have CSRF check when updating its permalink suffix settings, which could allow attackers to make logged admins perform such action via a CSRF attack",
+  "severity": [],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6860"
+    },
+    {
+      "type": "WEB",
+      "url": "https://wpscan.com/vulnerability/1d09d3dd-aa49-4ff1-80e7-6d176e378916"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-04-09T06:15:41Z"
+  }
+}