Wp Multitasking

Submit a proposal Propose CVE/GCVE/GHSA reference

Approved changes feed: RSS · Atom

cpe:2.3:a:ngothang:wp_multitasking:*:*:*:*:*:wordpress:*:*

part: a version: * update: *

VendorNgothang (20e48c33-ef8d-57a3-86d7-6c4770b7a712)
ProductWp Multitasking (3910e190-02c3-5fe5-a6be-d9435976d332)
Edition*
Language*
Software edition*
Target softwarewordpress
Target hardware*
Other*

Notes

Imported from gcve-enriched-dumps CVE data

PURL mappings

PURLSourceLast updated
No PURL mappings for this CPE yet.

Vulnerability references

IdentifiercpeApplicabilitySubmitteddb.gcve.eu detailsRationale
CVE:CVE-2024-8189 vulnerable 2026-06-08 07:00:22.990992 WP MultiTasking - WP Utilities <= 0.1.17 - Authenticated (Administrator+) Stored Cross-Site Scripting
MEDIUM (4.4)
The WP MultiTasking – WP Utilities plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘wpmt_menu_name’ parameter in all versions up to, and including, 0.1.17 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Published: 2024-09-28T12:31:55.348Z
Updated: 2026-04-08T16:35:06.322Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2024-6860 vulnerable 2026-06-08 06:58:20.613998 WP MultiTasking <= 0.1.12 - Permalink Suffix Update via CSRF
The WP MultiTasking WordPress plugin through 0.1.12 does not have CSRF check when updating its permalink suffix settings, which could allow attackers to make logged admins perform such action via a CSRF attack
Published: 2025-04-09T06:00:05.104Z
Updated: 2025-04-09T19:11:40.133Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2024-6859 vulnerable 2026-06-08 06:58:20.613601 WP MultiTasking <= 0.1.12 - Reflected XSS via Shortcode
The WP MultiTasking WordPress plugin through 0.1.12 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Published: 2024-09-08T06:00:02.961Z
Updated: 2024-09-09T19:52:01.460Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2024-6857 vulnerable 2026-06-08 06:58:20.605675 WP MultiTasking <= 0.1.12 - Header/Footer/Body Script Update via CSRF
The WP MultiTasking WordPress plugin through 0.1.12 does not have CSRF check when updating its Header, Footer and Body Script Settings, which could allow attackers to make logged admins perform such action via a CSRF attack
Published: 2025-04-09T06:00:04.059Z
Updated: 2025-04-09T19:17:05.474Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2024-6856 vulnerable 2026-06-08 06:58:20.605294 WP MultiTasking <= 0.1.12 - SMTP Settings Update via CSRF
The WP MultiTasking WordPress plugin through 0.1.12 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
Published: 2024-09-08T06:00:02.783Z
Updated: 2024-09-09T19:50:34.925Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2024-6855 vulnerable 2026-06-08 06:58:20.604909 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2024-6853 vulnerable 2026-06-08 06:58:20.604023 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2024-6852 vulnerable 2026-06-08 06:58:20.603383 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.

Inspect record JSON

Open JSON directly

Open this panel to browse, search, copy or download the JSON record.