Read the docs

SigmaPlugin

Records9All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high5CVSS 7.0–8.9

Exploited now

SigmaPlugin records in CISA KEV

No SigmaPlugin vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Advanced Database Cleaner 6 records LOW Advanced Wordpress Reset 1 record LOW

Records

6 records in Advanced Database Cleaner · all components

TI-2024-00615 CVE-2024-0668 · GHSA-fvvm-3cr2-6qx2

Advanced Database Cleaner <= 3.1.3 - Authenticated(Administrator+) PHP Object Injection via process_bulk_action

Priority LOW 36

The Advanced Database Cleaner plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.1.3 via deserialization of untrusted input in the 'process_bulk_action' function.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.01139 Published 2024-02-05 No fix listed CWE-502
TI-2021-06433 CVE-2021-24141 · GHSA-6h67-c8r4-fr78

Advanced Database Cleaner < 3.0.2 - Authenticated SQL injection

Priority LOW 34

Unvaludated input in the Advanced Database Cleaner plugin, versions before 3.0.2, lead to SQL injection allowing high privilege users (admin+) to perform SQL attacks.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.01205 Published 2021-03-18 Fixed in 3.0.2 CWE-89
TI-2022-02011 CVE-2022-2173 · GHSA-h52v-6ppv-4xw2

Advanced Database Cleaner < 3.1.1 - Reflected Cross-Site Scripting

Priority LOW 29

The Advanced Database Cleaner WordPress plugin before 3.1.1 does not escape numerous generated URLs before outputting them back in href attributes of admin dashboard pages, leading to Reflected Cross-Site Scripting

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00788 Published 2022-07-17 Fixed in 3.1.1 CWE-79
TI-2021-07201 CVE-2021-24921 · GHSA-8x47-hqwx-vmvf

Advanced Database Cleaner < 3.0.4 - Reflected Cross-Site Scripting

Priority LOW 29

The Advanced Database Cleaner WordPress plugin before 3.0.4 does not sanitise and escape $_GET keys and values before outputting them back in attributes, leading to Reflected Cross-Site Scripting issues

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.008 Published 2022-02-21 Fixed in 3.0.4 CWE-79
Open these records in search →