Vulnerabilities and security researches formpl-publisher mpl-publisher

Jun 07, 2024

CVE, Research URL: CVE-2021-39343
Home page URL: Security reports for MPL-Publisher — Ebook & Audiobook Creator
Application: MPL-Publisher — Ebook & Audiobook Creator
Date: Oct 19, 2021
Research Description: The MPL-Publisher WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and sanitization via several parameters found in the ~/libs/PublisherController.php file which allowed attackers with administrative user access to inject arbitrary web scripts, in versions up to and including 1.30.2. This affects multi-site installations where unfiltered_html is disabled for administrators, and sites where unfiltered_html is disabled.
Affected versions: Min -, max -.
Status: vulnerable

Apr 24, 2025

CVE, Research URL: CVE-2025-46226
Home page URL: Security reports for MPL-Publisher — Ebook & Audiobook Creator
Application: MPL-Publisher — Ebook & Audiobook Creator
Date: Apr 22, 2025
Research Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ferranfg MPL-Publisher allows Stored XSS. This issue affects MPL-Publisher: from n/a through 2.18.0.
Affected versions: Min -, max -.
Status: vulnerable