CVE-2024-12207

The Toggles Shortcode and Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘content’ parameter in all versions up to, and including, 1.14 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

• CWE-79

• https://plugins.trac.wordpress.org/browser/toggles-shortcode-and-widget/trunk/include/otw_components/otw_shortcode/shortcodes/otw_shortcode_content_toggle.class.php#L246
• https://www.wordfence.com/threat-intel/vulnerabilities/id/755c8863-33c2-47aa-880a-0ef8b2d594a3?source=cve

Published

Jan 7, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-12201The Hash Form – Drag & Drop Form Builder plugin for WordPres…4.3
• CVE-2024-12202The Croma Music plugin for WordPress is vulnerable to unauth…8.8
• CVE-2024-12203The RSS Icon Widget plugin for WordPress is vulnerable to St…4.4
• CVE-2024-12204The Coupon X: Discount Pop Up, Promo Code Pop Ups, Announcem…5.4
• CVE-2024-12205The Themesflat Addons For Elementor plugin for WordPress is …5.4
• CVE-2024-12206The WordPress Header Builder Plugin – Pearl plugin for WordP…4.3
• CVE-2024-12208Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2024-12209The WP Umbrella: Update Backup Restore & Monitoring plugin f…9.8
• CVE-2024-1221This vulnerability potentially allows files on a PaperCut NG…3.1
• CVE-2024-12210The Print Invoice & Delivery Notes for WooCommerce plugin fo…4.3
• CVE-2024-12211Pega Platform versions 8.1 to Infinity 24.2.0 are affected b…5.4
• CVE-2024-12212The vulnerability occurs in the parsing of CSP files. The is…8.5