Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

2 records

Vendor: PublishPress Component: Capabilities Clear all filters
TI-2022-03111 CVE-2022-3366 · GHSA-x27x-7595-v3m5

PublishPress Capabilities < 2.5.2 - Admin+ PHP Objection Injection

Priority HIGH 67

The PublishPress Capabilities WordPress plugin before 2.5.2, PublishPress Capabilities Pro WordPress plugin before 2.5.2 unserializes the content of imported files, which could lead to PHP object injection attacks by adm…

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.01485 Published 2022-10-31 Fixed in 2.5.2 CWE-502
TI-2021-07310 CVE-2021-25032 · GHSA-jvmr-8pwj-ffqf

PublishPress Capabilities < 2.3.1 - Unauthenticated Arbitrary Options Update to Blog Compromise

Priority MEDIUM 52

The PublishPress Capabilities WordPress plugin before 2.3.1, PublishPress Capabilities Pro WordPress plugin before 2.3.1 does not have authorisation and CSRF checks when updating the plugin's settings via the init hook,…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.07069 Published 2022-01-10 Fixed in 2.3.1 CWE-352