Threat Entry Updated 2025-05-14

CVE-2024-2907 - Absolutely Glamorous Custom Admin Plugin

The AGCA WordPress plugin before 7.2.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).

PLUGIN Absolutely Glamorous Custom Admin

CVE-2024-2907

MEDIUM CVSS 6.8 2024-04-25

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2024-11-21

CVE-2021-24944 - Absolutely Glamorous Custom Admin Plugin

The Custom Dashboard & Login Page WordPress plugin before 7.0 does not sanitise some of its settings, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.

PLUGIN Absolutely Glamorous Custom Admin

CVE-2021-24944

MEDIUM CVSS 4.8 2022-02-01

Risk Score

Open Full Technical Breakdown