Read the docs

specialk

Records45All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical3CVSS 9.0–10.0
CVSS high9CVSS 7.0–8.9

Exploited now

specialk records in CISA KEV

No specialk vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
User Submitted Posts 6 records MEDIUM Simple Ajax Chat 5 records MEDIUM Dashboard Widget Suite 2 records LOW Prismatic 2 records LOW Simple Download Counter 2 records LOW Theme Switcha 2 records LOW Blackhole For Bad Bots 1 record MEDIUM Contact Form X 1 record LOW

Records

6 records in User Submitted Posts · all components

TI-2024-04645 CVE-2024-5002 · GHSA-ggxx-7xgm-c5m6

User Submitted Posts < 20240516 - Admin+ Stored XSS

Priority MEDIUM 55

The User Submitted Posts WordPress plugin before 20240516 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when t…

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00423 Published 2024-07-13 Fixed in 20240516 CWE-79
TI-2019-15241 CVE-2019-25138 · GHSA-wrjq-6j55-j564

User Submitted Posts <= 20190312 - Unauthenticated Arbitrary File Upload

Priority MEDIUM 53

The User Submitted Posts plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the usp_check_images function in versions up to, and including, 20190312.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02326 Published 2023-06-07 Fixed in 20190426 CWE-434
TI-2023-24406 CVE-2023-45603 · GHSA-4v55-6j3q-q3g7

WordPress User Submitted Posts Plugin <= 20230902 is vulnerable to Arbitrary File Upload

Priority MEDIUM 44

Unrestricted Upload of File with Dangerous Type vulnerability in Jeff Starr User Submitted Posts – Enable Users to Submit Posts from the Front End.This issue affects User Submitted Posts – Enable Users to Submit Posts fr…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00975 Published 2023-12-20 No fix listed CWE-434
TI-2023-03982 CVE-2023-4308 · GHSA-cxw2-5qm7-6j42

User Submitted Posts <= 20230809 - Unauthenticated Stored Cross-Site Scripting via 'user-submitted-content'

Priority LOW 38

The User Submitted Posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘user-submitted-content’ parameter in versions up to, and including, 20230809 due to insufficient input sanitization and…

CVSS 3.1HIGH 7.2 Network No auth No interaction EPSS 0.0042 Published 2023-08-15 No fix listed CWE-79
TI-2023-04406 CVE-2023-4779 · GHSA-3c82-f6j3-5x2g

Cross-site scripting in specialk User Submitted Posts – Enable Users to Submit Posts from…

Priority LOW 29

The User Submitted Posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's [usp_gallery] shortcode in versions up to, and including, 20230811 due to insufficient input sanitization and ou…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00384 Published 2023-09-06 No fix listed CWE-79
Open these records in search →