CVE-2024-8189

The WP MultiTasking – WP Utilities plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘wpmt_menu_name’ parameter in all versions up to, and including, 0.1.17 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

• CWE-79

• https://plugins.trac.wordpress.org/browser/wp-multitasking/trunk/wp-multitasking.php#L29Product
• https://plugins.trac.wordpress.org/browser/wp-multitasking/trunk/wp-multitasking.php#L71Product
• https://plugins.trac.wordpress.org/changeset/3158305/Patch
• https://www.wordfence.com/threat-intel/vulnerabilities/id/0c976e5a-2f6c-4632-99a7-a512b3dd38e6?source=cveThird Party Advisory

Published

Sep 28, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-8183A CORS (Cross-Origin Resource Sharing) misconfiguration in p…7.6
• CVE-2024-8184There exists a security vulnerability in Jetty's ThreadLimit…6.5
• CVE-2024-8185Vault Community and Vault Enterprise (“Vault”) clusters usin…7.5
• CVE-2024-8186An issue has been discovered in GitLab CE/EE affecting all v…5.4
• CVE-2024-8187The Smart Post Show WordPress plugin before 3.0.1 does not …4.8
• CVE-2024-8188Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2024-8190An OS command injection vulnerability in Ivanti Cloud Servic…7.2
• CVE-2024-8191SQL injection in the management console of Ivanti EPM before…9.8
• CVE-2024-8193Heap buffer overflow in Skia in Google Chrome prior to 128.0…8.8
• CVE-2024-8194Type Confusion in V8 in Google Chrome prior to 128.0.6613.11…8.8
• CVE-2024-8195The Permalink Manager Lite plugin for WordPress is vulnerabl…5.3
• CVE-2024-8196In mintplex-labs/anything-llm v1.5.11 desktop version for Wi…9.8