Read the docs

pluginbuilders

Records14All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high2CVSS 7.0–8.9

Exploited now

pluginbuilders records in CISA KEV

No pluginbuilders vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Yourchannel 9 records MEDIUM Waiting 5 records HIGH

Records

9 records in Yourchannel · all components

TI-2023-00267 CVE-2023-0282 · GHSA-x28p-2rmr-cx3p

YourChannel < 1.2.2 - Subscriber+ Stored XSS

Priority MEDIUM 58

The YourChannel WordPress plugin before 1.2.2 does not sanitize and escape some parameters, which could allow users with a role as low as Subscriber to perform Cross-Site Scripting attacks.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.0051 Published 2023-02-06 Fixed in 1.2.2
TI-2022-04429 CVE-2022-4833 · GHSA-w5hq-mq5m-5f94

YourChannel: Everything you want in a YouTube plugin < 1.2.3 - Contributor+ Stored XSS via Shortcode

Priority MEDIUM 58

The YourChannel: Everything you want in a YouTube plugin WordPress plugin before 1.2.3 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.0055 Published 2023-02-06 Fixed in 1.2.3
TI-2023-01755 CVE-2023-1868 · GHSA-2779-qh7w-73rg

YourChannel <= 1.2.3 - Missing Authorization to Plugin Cache Reset

Priority LOW 36

The YourChannel plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check when clearing the plugin cache via the yrc_clear_cache GET parameter in versions up to, and including, 1.2…

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00615 Published 2023-04-05 No fix listed CWE-862
TI-2023-01752 CVE-2023-1865 · GHSA-5c8g-9448-5x46

YourChannel <= 1.2.3 - Missing Authorization to Plugin Settings Reset

Priority LOW 36

The YourChannel plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check when resetting plugin settings via the yrc_nuke GET parameter in versions up to, and including, 1.2.3.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00705 Published 2023-04-05 No fix listed CWE-862
TI-2023-01756 CVE-2023-1869 · GHSA-r6p9-mgqc-wrwp

YourChannel <= 1.2.5 - Authenticated (Administrator+) Stored Cross-Site Scripting

Priority LOW 25

The YourChannel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 1.2.5 due to insufficient input sanitization and output escaping.

CVSS 3.1MEDIUM 5.5 Network High privileges No interaction EPSS 0.00482 Published 2023-04-05 No fix listed CWE-79
Open these records in search →