Read the docs

UltimatelySocial

Records6All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high2CVSS 7.0–8.9

Exploited now

UltimatelySocial records in CISA KEV

No UltimatelySocial vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Social Media Share Buttons & Social Sharing Icons 5 records LOW Usm Premium 1 record MEDIUM

Records

6 records

TI-2023-01104 CVE-2023-1166 · GHSA-chj2-8247-g69q

USM Premium < 16.3 - Admin+ Stored XSS

Priority MEDIUM 55

The USM-Premium WordPress plugin before 16.3 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered…

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00477 Published 2023-06-27 Fixed in 16.3
TI-2023-04665 CVE-2023-5070 · GHSA-g8cv-hhj5-2rjx

Social Media Share Buttons & Social Sharing Icons <= 2.8.5 - Information Exposure

Priority LOW 32

The Social Media Share Buttons & Social Sharing Icons plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 2.8.5 via the sfsi_save_export function.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01465 Published 2023-10-20 No fix listed CWE-200
TI-2023-00909 CVE-2023-0958 · GHSA-hpq9-m2jp-4fgr

Inisev Plugins (Various Versions) - Missing Authorization on handle_installation function

Priority LOW 30

Several plugins for WordPress by Inisev are vulnerable to unauthorized installation of plugins due to a missing capability check on the handle_installation function that is called via the inisev_installation AJAX aciton…

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00691 Published 2023-07-28 No fix listed CWE-862
TI-2023-03692 CVE-2023-3977 · GHSA-6jhg-gg85-9xxf

Inisev Plugins (Various Versions) - Cross-Site Request Forgery on handle_installation function

Priority LOW 21

Several plugins for WordPress by Inisev are vulnerable to Cross-Site Request Forgery to unauthorized installation of plugins due to a missing nonce check on the handle_installation function that is called via the inisev_…

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00611 Published 2023-07-28 No fix listed CWE-352
Open these records in search →