Read the docs

mra13

Records89All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical5CVSS 9.0–10.0
CVSS high20CVSS 7.0–8.9

Exploited now

mra13 records in CISA KEV

No mra13 vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Wp Affiliate Platform 11 records MEDIUM All In One Wp Security & Firewall 10 records MEDIUM Wp Emember 10 records HIGH Simple Download Monitor 9 records MEDIUM Wp Estore 8 records HIGH Wordpress Simple Paypal Shopping Cart 7 records MEDIUM Category Specific Rss Feed Subscription 3 records MEDIUM Compact Wp Audio Player 3 records HIGH

Records

3 records in Compact Wp Audio Player · all components

TI-2022-04146 CVE-2022-4542 · GHSA-v234-jrgr-8q98

Compact WP Audio Player < 1.9.8 - Contributor+ Stored XSS

Priority HIGH 66

The Compact WP Audio Player WordPress plugin before 1.9.8 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor t…

CVSS 3.1MEDIUM 5.4 Network No auth User interaction EPSS 0.00476 Published 2023-01-23 Fixed in 1.9.8
TI-2021-07017 CVE-2021-24735 · GHSA-c8jp-pc3c-h742

Compact WP Audio Player < 1.9.7 - Setting Change via CSRF

Priority LOW 30

The Compact WP Audio Player WordPress plugin before 1.9.7 does not implement nonce checks, which could allow attackers to make a logged in admin change the "Disable Simultaneous Play" setting via a CSRF attack.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00572 Published 2021-10-18 Fixed in 1.9.7 CWE-352
TI-2021-07016 CVE-2021-24734 · GHSA-mc96-xvr9-9pqc

Compact WP Audio Player < 1.9.7 - Contributor+ Stored Cross-Site Scripting

Priority LOW 25

The Compact WP Audio Player WordPress plugin before 1.9.7 does not escape some of its shortcodes attributes, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.0065 Published 2021-10-18 Fixed in 1.9.7 CWE-79
Open these records in search →