Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

5 records

Vendor: cybernetikz Component: Easy Social Icons Clear all filters
TI-2022-00747 CVE-2022-0840 · GHSA-qp34-j2qv-6pv6

Easy Social Icons < 3.2.1 - Admin+ Stored Cross-Site Scripting in add icon

Priority LOW 23

The Easy Social Icons WordPress plugin before 3.2.1 does not properly escape the image_file field when adding a new social icon, allowing high privileged users to inject arbitrary javascript even when the unfiltered_html…

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00598 Published 2022-04-11 Fixed in 3.2.1 CWE-79
TI-2022-00791 CVE-2022-0887 · GHSA-fqw9-gq3m-ggrh

Easy Social Icons < 3.1.4 - Admin+ SQL Injection

Priority LOW 34

The Easy Social Icons WordPress plugin before 3.1.4 does not sanitize the selected_icons attribute to the cnss_widget before using it in an SQL statement, leading to a SQL injection vulnerability.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.0131 Published 2022-04-04 Fixed in 3.1.4 CWE-89
TI-2021-16694 CVE-2021-39322 · GHSA-4p2p-7qjx-7r5g

Easy Social Icons <= 3.0.8 - Reflected Cross-Site Scripting

Priority LOW 32

The Easy Social Icons plugin <= 3.0.8 for WordPress echoes out the raw value of `$_SERVER['PHP_SELF']` in its main file.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.02349 Published 2021-09-02 No fix listed CWE-79