CVE-2023-4284 | BDVDB-2026-210992 Detail

Post Timeline

Description#

The Post Timeline WordPress plugin before 2.2.6 does not sanitise and escape an invalid nonce before outputting it back in an AJAX response, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin

Impact#

No impact statement in the source data.

Weaknesses#

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

References#

https://wpscan.com/vulnerability/1c126869-0afa-456f-94cc-10334964e5f9

Exploit#

https://wpscan.com/vulnerability/1c126869-0afa-456f-94cc-10334964e5f9

History#

Version 12023-09-04Record published in the CVE List.
Version 22025-03-06Most recent update recorded in the CVE List.