Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

2 records

Vendor: Cm-wp Component: Auto Featured Image Clear all filters
TI-2023-00452 CVE-2023-0477 · GHSA-xv6m-g863-2r99

Auto Featured Image < 3.9.16 - Author+ Arbitrary File Upload

Priority HIGH 73

The Auto Featured Image (Auto Post Thumbnail) WordPress plugin before 3.9.16 includes an AJAX endpoint that allows any user with at least Author privileges to upload arbitrary files, such as PHP files.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01645 Published 2023-03-13 Fixed in 3.9.16 CWE-434
TI-2021-07211 CVE-2021-24932 · GHSA-9xfx-427g-vgqq

Auto Featured Image < 3.9.3 - Reflected Cross-Site Scripting

Priority LOW 29

The Auto Featured Image (Auto Post Thumbnail) WordPress plugin before 3.9.3 does not sanitise and escape the post_id parameter before outputting back in an admin page within a JS block, leading to a Reflected Cross-Site…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00827 Published 2021-12-13 Fixed in 3.9.3 CWE-79