XSS Vulnerability - page 2 | WordPress.org

Resolved JulesWebb
(@juleswebb)

1 year, 5 months ago

Hello

I just wanted to give you a heads up that there’s been a report of an XSS vulnerability in the WP Dashboard Notes plugin (version 1.0.11 and earlier).

Are you aware of this issue and do you have any plans to release an update with a fix?

Thanks!
Jules

Viewing 5 replies - 16 through 20 (of 20 total)

Plugin Author Jeroen Sormani
(@sormano)

1 year, 1 month ago

I was unable to replicate this on private notes – only public notes which is how its meant to be. I asked for additional details; https://imgur.com/a/myoXs7w

Darius Sveikauskas (Patchstack)
(@darius_fx)

1 year, 1 month ago

@sormano nope, I don’t have those emails in my mailbox and we are not deleting any emails to make sure we have whole history of interaction with developers, vendors, etc. please sent email to darius.sveikauskas[at]patchstack[dot]com. Thank you.

Plugin Author Jeroen Sormani
(@sormano)

1 year, 1 month ago

Forwarded it.

Darius Sveikauskas (Patchstack)
(@darius_fx)

1 year, 1 month ago

We got explanation from the vendor, vulnerability rejected. Thank you.

Plugin Author Jeroen Sormani
(@sormano)

1 year, 1 month ago

To elaborate on this; the ‘vulnerability’ that was detected was about public notes being editable by any registered user – which is intentional.

Viewing 5 replies - 16 through 20 (of 20 total)

The topic ‘XSS Vulnerability’ is closed to new replies.

26 replies
4 participants
Last reply from: Jeroen Sormani
Last activity: 1 year, 1 month ago
Status: resolved