Internet-formation

Records5All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical1CVSS 9.0–10.0

CVSS high2CVSS 7.0–8.9

Exploited now

Internet-formation records in CISA KEV

No Internet-formation vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Wp-advanced-search 4 records HIGH Modal Portfolio 1 record LOW

Records

5 records

TI-2024-09091 CVE-2024-9796 · GHSA-hxx7-vhm6-3427

WP-Advanced-Search < 3.3.9.2 - Unauthenticated SQL Injection

HIGH 76

The WP-Advanced-Search WordPress plugin before 3.3.9.2 does not sanitize and escape the t parameter before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02996 Published 2024-10-10 Fixed in 3.3.9.2 CWE-89

TI-2024-09777 CVE-2024-10554 · GHSA-q27q-f4wr-gh4j

WP-Advanced-Search < 3.3.9.3 - Admin+ Stored XSS

MEDIUM 50

The WordPress WP-Advanced-Search WordPress plugin before 3.3.9.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even…

CVSS 3.1LOW 3.5 Network High privileges User interaction EPSS 0.00324 Published 2025-03-25 Fixed in 3.3.9.3 CWE-79

TI-2020-09739 CVE-2020-12104 · GHSA-mh87-x5p4-6j68

The Import feature in the wp-advanced-search plugin 3.3.6 for WordPress is vulnerable to…

MEDIUM 41

The Import feature in the wp-advanced-search plugin 3.3.6 for WordPress is vulnerable to authenticated SQL injection via an uploaded .sql file.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01602 Published 2020-05-05 No fix listed CWE-89

TI-2022-23524 CVE-2022-47447 · GHSA-rp8x-pfj5-c893

WordPress WP-Advanced-Search Plugin <= 3.3.8 is vulnerable to Cross Site Request Forgery (CSRF)

LOW 38

Cross-Site Request Forgery (CSRF) vulnerability in Mathieu Chartier WordPress WP-Advanced-Search plugin <= 3.3.8 versions.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.0026 Published 2023-05-24 No fix listed CWE-352

TI-2024-12872 CVE-2024-13851 · GHSA-fp3v-vr72-3gmh

Modal Portfolio <= 1.7.4.2 - Authenticated (Administrator+) Stored Cross-Site Scripting

LOW 24

The Modal Portfolio plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 1.7.4.2 due to insufficient input sanitization and output escaping.

CVSS 3.1MEDIUM 5.5 Network High privileges No interaction EPSS 0.00246 Published 2025-02-28 No fix listed CWE-79

Open these records in search →

Critical	1
High	2
Medium	1
Low	1
No CVSS	0