Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

2 records

Vendor: CreativeMindsSolutions Component: Cm Table Of Contents Clear all filters
TI-2024-04670 CVE-2024-5029 · GHSA-26fv-px38-wm73

CM Table Of Contents – WordPress TOC Plugin < 1.2.4 - Stored XSS via CSRF

Priority MEDIUM 55

The CM Table Of Contents WordPress plugin before 1.2.4 does not have CSRF check when updating its settings, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored…

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00225 Published 2024-11-21 Fixed in 1.2.4 CWE-352
TI-2024-04671 CVE-2024-5030 · GHSA-v664-p69f-2qfg

CM Table Of Contents – WordPress TOC Plugin < 1.2.3 - Settings Reset via CSRF

Priority MEDIUM 51

The CM Table Of Contents WordPress plugin before 1.2.3 does not have CSRF check in place when resetting its settings, which could allow attackers to make a logged in admin perform such action via a CSRF attack

CVSS 3.1LOW 3.8 Network High privileges No interaction EPSS 0.00199 Published 2024-11-18 Fixed in 1.2.3 CWE-352