Wpcode

Records3All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical0CVSS 9.0–10.0

CVSS high0CVSS 7.0–8.9

Exploited now

Wpcode records in CISA KEV

No Wpcode vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Wpcode 3 records MEDIUM

Records

3 records in Wpcode · all components

TI-2023-01528 CVE-2023-1624 · GHSA-2h2j-55g7-g43c

WPCode Lite < 2.0.9 - Arbitrary Log File Deletion via CSRF

MEDIUM 62

The WPCode WordPress plugin before 2.0.9 has a flawed CSRF when deleting log, and does not ensure that the file to be deleted is inside the expected folder.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00307 Published 2023-04-24 Fixed in 2.0.9

TI-2023-03289 CVE-2023-3524 · GHSA-h799-5x6c-6gv8

WPCode < 2.0.13.1 - Reflected XSS

MEDIUM 60

The WPCode WordPress plugin before 2.0.13.1 does not escape generated URLs before outputting them in attributes, leading to Reflected Cross-Site Scripting

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00522 Published 2023-08-07 Fixed in 2.0.13.1

TI-2023-00312 CVE-2023-0328 · GHSA-fc29-rq2p-4h73

WPCode < 2.0.7 - Contributor+ WPCode Library Auth Key Update/Deletion

MEDIUM 53

The WPCode WordPress plugin before 2.0.7 does not have adequate privilege checks in place for several AJAX actions, only checking the nonce.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00801 Published 2023-03-06 Fixed in 2.0.7 CWE-863

Open these records in search →

Critical	0
High	0
Medium	3
Low	0
No CVSS	0