Wow-estore

Records7All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical0CVSS 9.0–10.0

CVSS high4CVSS 7.0–8.9

Exploited now

Wow-estore records in CISA KEV

No Wow-estore vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Side Menu 3 records MEDIUM Button Generator - Easily Button Builder 1 record LOW Float Menu 1 record LOW Herd Effects 1 record LOW Popup Box 1 record LOW

Records

7 records

TI-2021-06864 CVE-2021-24580 · GHSA-2mxj-pg8q-6c2c

Side Menu Lite < 2.2.6 - Authenticated SQL Injection

MEDIUM 41

The Side Menu Lite WordPress plugin before 2.2.6 does not sanitise user input from the List page in the admin dashboard before using it in SQL statement, leading to a SQL Injection issue

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01362 Published 2021-08-30 Fixed in 2.2.6 CWE-89

TI-2022-11915 CVE-2022-29445 · GHSA-7jq5-gwqv-xc5f

WordPress Popup Box plugin <= 2.1.2 - Authenticated Local File Inclusion (LFI) vulnerability

LOW 36

Authenticated (administrator or higher role) Local File Inclusion (LFI) vulnerability in Wow-Company's Popup Box plugin <= 2.1.2 at WordPress.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.0105 Published 2022-05-18 No fix listed CWE-706

TI-2021-06808 CVE-2021-24521 · GHSA-39jf-84mp-m232

Side Menu Lite < 2.2.1 - Authenticated SQL Injection

LOW 35

The Side Menu Lite – add sticky fixed buttons WordPress plugin before 2.2.1 does not properly sanitize input values from the browser when building an SQL statement.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.01587 Published 2021-08-09 Fixed in 2.2.1 CWE-89

TI-2021-06640 CVE-2021-24348 · GHSA-3545-vxgq-p67f

Side Menu < 3.1.5 - Authenticated (admin+) SQL Injection

LOW 35

The menu delete functionality of the Side Menu – add fixed side buttons WordPress plugin before 3.1.5, available to Administrator users takes the did GET parameter and uses it into an SQL statement without proper sanitis…

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.01565 Published 2021-06-14 Fixed in 3.1.5 CWE-89

TI-2022-11918 CVE-2022-29448 · GHSA-pq6j-c37f-96x2

WordPress Herd Effects plugin <= 5.2 - Local File Inclusion (LFI) vulnerability

LOW 34

Authenticated (admin or higher user role) Local File Inclusion (LFI) vulnerability in Wow-Company's Herd Effects plugin <= 5.2 at WordPress.

CVSS 3.1MEDIUM 6.8 Network High privileges User interaction EPSS 0.01027 Published 2022-05-20 No fix listed CWE-706

TI-2023-12184 CVE-2023-27452 · GHSA-pf84-fx8r-4c89

WordPress Button Generator – easily Button Builder Plugin <= 2.3.3 is vulnerable to Cross Site Scripting (XSS)

LOW 27

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Wow-Company Button Generator – easily Button Builder plugin <= 2.3.3 versions.

CVSS 3.1MEDIUM 5.9 Network High privileges User interaction EPSS 0.00369 Published 2023-06-22 No fix listed CWE-79

TI-2022-00242 CVE-2022-0313 · GHSA-rp6m-v76g-9wr4

Float Menu < 4.3.1 - Arbitrary Menu Deletion via CSRF

LOW 20

The Float menu WordPress plugin before 4.3.1 does not have CSRF check in place when deleting menu, which could allow attackers to make a logged in admin delete them via a CSRF attack

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00471 Published 2022-02-21 Fixed in 4.3.1 CWE-352

Open these records in search →

Critical	0
High	4
Medium	3
Low	0
No CVSS	0