Vulnerabilities

TI-2023-28141 CVE-2023-51489 · GHSA-gwh7-h623-wx42

WordPress Crowdsignal Polls & Ratings plugin <= 3.0.11 - Cross Site Request Forgery (CSRF) vulnerability

LOW 37

Cross-Site Request Forgery (CSRF) vulnerability in Automattic, Inc.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00221 Published 2024-03-16 No fix listed CWE-352

TI-2023-28140 CVE-2023-51488 · GHSA-jcfw-r7j2-hvv7

WordPress Crowdsignal Dashboard – Polls, Surveys & more Plugin <= 3.0.11 is vulnerable to Cross Site Scripting (XSS)

LOW 31

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Automattic, Inc.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00351 Published 2024-02-10 No fix listed CWE-79

TI-2022-22160 CVE-2022-45069 · GHSA-fm88-83w7-ffcv

WordPress Crowdsignal Dashboard plugin <= 3.0.9 - Privilege Escalation vulnerability

LOW 39

Auth. (contributor+) Privilege Escalation vulnerability in Crowdsignal Dashboard plugin <= 3.0.9 on WordPress.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00774 Published 2022-11-17 No fix listed CWE-264

TI-2022-02202 CVE-2022-2386 · GHSA-xpmf-95jh-4h75

Crowdsignal Polls & Ratings < 3.0.8 - Reflected Cross-Site Scripting

LOW 28

The Crowdsignal Dashboard WordPress plugin before 3.0.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00644 Published 2022-08-08 Fixed in 3.0.8 CWE-79

Vulnerabilities

Filters

WordPress Crowdsignal Polls & Ratings plugin <= 3.0.11 - Cross Site Request Forgery (CSRF) vulnerability

WordPress Crowdsignal Dashboard – Polls, Surveys & more Plugin <= 3.0.11 is vulnerable to Cross Site Scripting (XSS)

WordPress Crowdsignal Dashboard plugin <= 3.0.9 - Privilege Escalation vulnerability

Crowdsignal Polls & Ratings < 3.0.8 - Reflected Cross-Site Scripting