wpvar

Records3All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical0CVSS 9.0–10.0

CVSS high0CVSS 7.0–8.9

Exploited now

wpvar records in CISA KEV

No wpvar vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Wp Shamsi 3 records MEDIUM

Records

3 records in Wp Shamsi · all components

TI-2023-00319 CVE-2023-0335 · GHSA-jhxw-3422-m7cw

WP Shamsi <= 4.3.3 - Subscriber+ Attachment Deletion

MEDIUM 62

The WP Shamsi WordPress plugin through 4.3.3 has CSRF and broken access control vulnerabilities which leads user with role as low as subscriber delete attachment.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01003 Published 2023-03-27 No fix listed CWE-352

TI-2022-04159 CVE-2022-4555 · GHSA-2pq5-28h7-2x78

WP Shamsi <= 4.1.0 - Missing Authorization to Arbitrary Plugin Deactivation

LOW 36

The WP Shamsi plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the deactivate() function hooked via init() in versions up to, and including, 4.1.0.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00716 Published 2022-12-16 No fix listed CWE-862

TI-2022-17772 CVE-2022-38058 · GHSA-r5qg-xhv7-vh2x

WordPress WP Shamsi plugin <= 4.1.1 - Authenticated Plugin Setting change vulnerability

LOW 21

Authenticated (subscriber+) Plugin Setting change vulnerability in WP Shamsi plugin <= 4.1.1 at WordPress.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00651 Published 2022-09-09 No fix listed CWE-264

Open these records in search →

Critical	0
High	0
Medium	3
Low	0
No CVSS	0