Read the docs

Wow-Company

Records61All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical2CVSS 9.0–10.0
CVSS high23CVSS 7.0–8.9

Exploited now

Wow-Company records in CISA KEV

No Wow-Company vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Modal Window 7 records LOW Counter Box 6 records MEDIUM Button Generator 5 records MEDIUM Wp Coder 5 records MEDIUM Herd Effects 4 records MEDIUM Bubble Menu 3 records MEDIUM Float Menu 3 records MEDIUM Side Menu Lite 3 records HIGH

Records

5 records in Wp Coder · all components

TI-2023-02217 CVE-2023-2362 · GHSA-vx6w-q89v-7755

Multiple Plugins from Wow-Company - Reflected XSS

Priority MEDIUM 60

The Float menu WordPress plugin before 5.0.2, Bubble Menu WordPress plugin before 3.0.4, Button Generator WordPress plugin before 2.3.5, Calculator Builder WordPress plugin before 1.5.1, Counter Box WordPress plugin befo…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00458 Published 2023-06-12 Fixed in 5.0.2, 3.0.4 +9
TI-2021-07331 CVE-2021-25053 · GHSA-pw9r-237f-q334

WP Coder < 2.5.2 - RFI leading to RCE via CSRF

Priority LOW 39

The WP Coder WordPress plugin before 2.5.2 within the wow-company admin menu page allows to include() arbitrary file with PHP extension (as well as with data:// or http:// protocols), thus leading to CSRF RCE.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00692 Published 2022-01-10 Fixed in 2.5.2 CWE-352
TI-2023-00847 CVE-2023-0895 · GHSA-m2hp-qjqj-65cw

WP Coder – add custom html, css and js code <= 2.5.3 - Authenticated (Admin+) SQL Injection

Priority LOW 35

The WP Coder – add custom html, css and js code plugin for WordPress is vulnerable to time-based SQL Injection via the ‘id’ parameter in versions up to, and including, 2.5.3 due to insufficient escaping on the user suppl…

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00798 Published 2023-02-17 No fix listed CWE-89
TI-2022-02204 CVE-2022-2388 · GHSA-3v49-f236-jv89

WP Coder < 2.5.3 - Code Deletion via CSRF

Priority LOW 29

The WP Coder WordPress plugin before 2.5.3 does not have CSRF check in place when deleting code created by the plugin, which could allow attackers to make a logged in admin delete arbitrary ones via a CSRF attack

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.0043 Published 2022-08-22 Fixed in 2.5.3 CWE-352
TI-2024-02398 CVE-2024-2578 · GHSA-xph7-pm58-q56v

WordPress WP Coder plugin <= 3.5 - Cross Site Scripting (XSS) vulnerability

Priority LOW 26

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPCoder WP Coder allows Stored XSS.This issue affects WP Coder: from n/a through 3.5.

CVSS 3.1MEDIUM 5.9 Network High privileges User interaction EPSS 0.00316 Published 2024-03-21 No fix listed CWE-79
Open these records in search →