Read the docs

Tiempo

Records3All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high0CVSS 7.0–8.9

Exploited now

Tiempo records in CISA KEV

No Tiempo vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Tiempo 3 records MEDIUM

Records

3 records

TI-2023-02131 CVE-2023-2272 · GHSA-px5c-85f9-xr32

Tiempo.com <= 0.1.2 - Reflected XSS

Priority MEDIUM 60

The Tiempo.com WordPress plugin through 0.1.2 does not sanitise and escape the page parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.0085 Published 2023-08-16 No fix listed
TI-2023-02130 CVE-2023-2271 · GHSA-g78h-3x72-cmgm

Tiempo.com <= 0.1.2 - Shortcode Deletion via CSRF

Priority MEDIUM 53

The Tiempo.com WordPress plugin through 0.1.2 does not have CSRF check when deleting its shortcode, which could allow attackers to make logged in admins delete arbitrary shortcode via a CSRF attack

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00252 Published 2023-08-16 No fix listed
TI-2023-00054 CVE-2023-0058 · GHSA-m256-5rj4-75c4

Tiempo.com <= 0.1.2 - Stored XSS via CSRF

Priority LOW 27

The Tiempo.com WordPress plugin through 0.1.2 does not have CSRF check when creating and editing its shortcode, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Sto…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00237 Published 2023-08-16 No fix listed
Open these records in search →