CVE-2024-11141

MEDIUM Year: 2024
CVSS v3 Score
6.1
Medium
Weakness Type
NVD-CWE-Other
View all →

Vulnerability Description

The Sailthru Triggermail WordPress plugin through 1.1 does not sanitise and escape some of its settings and is missing CSRF protection which could allow subscribers to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).

Related Vulnerabilities

CVE-2016-0359

MEDIUM
CVSS:6.1(Medium)

CRLF injection vulnerability in IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.43, 8.0 before 8.0.0.13, 8.5 Full before 8.5.5.10, and 8.5 Liberty before Liberty Fix Pack 16.0.0.2 allows remot...

NVD-CWE-Other2016

CVE-2016-0400

MEDIUM
CVSS:6.1(Medium)

CRLF injection vulnerability in IBM WebSphere eXtreme Scale 7.1.0 before 7.1.0.3, 7.1.1 before 7.1.1.1, 8.5 before 8.5.0.3, and 8.6 before 8.6.0.8 allows remote attackers to inject arbitrary HTTP head...

NVD-CWE-Other2016

CVE-2016-0479

MEDIUM
CVSS:6.1(Medium)

Unspecified vulnerability in the Oracle Business Intelligence Enterprise Edition component in Oracle Fusion Middleware 11.1.1.7.0, 11.1.1.9.0, and 12.2.1.0.0 allows remote attackers to affect confiden...

NVD-CWE-Other2016

CVE-2016-0640

MEDIUM
CVSS:6.1(Medium)

Unspecified vulnerability in Oracle MySQL 5.5.47 and earlier, 5.6.28 and earlier, and 5.7.10 and earlier and MariaDB before 5.5.48, 10.0.x before 10.0.24, and 10.1.x before 10.1.12 allows local users ...

NVD-CWE-Other2016

CVE-2016-0672

MEDIUM
CVSS:6.1(Medium)

Unspecified vulnerability in the Oracle FLEXCUBE Direct Banking component in Oracle Financial Services Software 12.0.2 and 12.0.3 allows remote attackers to affect confidentiality and integrity via ve...

NVD-CWE-Other2016

CVE-2016-0675

MEDIUM
CVSS:6.1(Medium)

Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6, 12.1.2, and 12.1.3 allows remote attackers to affect confidentiality and integrity via vectors rel...

NVD-CWE-Other2016