High · 7.1 CVE-2024-51653 EUVD-2024-45587GHSA-24vh-3994-4wxm

WordPress UPDATE NOTIFICATIONS plugin <= 0.3.4 - CSRF to Stored Cross Site Scripting (XSS) vulnerability

Published Nov 19, 2024 · Updated May 11, 2026 · Assigned by Patchstack

Vendor: akira1891 Product: UPDATE NOTIFICATIONS

Description

Cross-Site Request Forgery (CSRF) vulnerability in akira1891 UPDATE NOTIFICATIONS update-notifications allows Stored XSS.This issue affects UPDATE NOTIFICATIONS: from n/a through <= 0.3.4.

Affected products

Vendor	Product	Affected	Fixed
akira1891	UPDATE NOTIFICATIONS	≤ 0.3.4	—

References

https://patchstack.com/database/Wordpress/Plugin/update-notifications/vulnerability/wordpress-update-notifications-plugin-0-3-4-csrf-to-stored-cross-site-scripting-xss-vulnerability?_s_id=cve vdb-entry