Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

3 records

Vendor: inisev Component: Enhanced Text Widget Clear all filters
TI-2024-00517 CVE-2024-0559 · GHSA-gq6r-j83x-w77v

Enhanced Text Widget < 1.6.6 - Admin+ Stored XSS

Priority MEDIUM 62

The Enhanced Text Widget WordPress plugin before 1.6.6 does not validate and escape some of its Widget options before outputting them back in attributes, which could allow high privilege users such as admin to perform St…

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00497 Published 2024-03-11 Fixed in 1.6.6 CWE-79
TI-2023-00909 CVE-2023-0958 · GHSA-hpq9-m2jp-4fgr

Inisev Plugins (Various Versions) - Missing Authorization on handle_installation function

Priority LOW 30

Several plugins for WordPress by Inisev are vulnerable to unauthorized installation of plugins due to a missing capability check on the handle_installation function that is called via the inisev_installation AJAX aciton…

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00691 Published 2023-07-28 No fix listed CWE-862
TI-2023-03692 CVE-2023-3977 · GHSA-6jhg-gg85-9xxf

Inisev Plugins (Various Versions) - Cross-Site Request Forgery on handle_installation function

Priority LOW 21

Several plugins for WordPress by Inisev are vulnerable to Cross-Site Request Forgery to unauthorized installation of plugins due to a missing nonce check on the handle_installation function that is called via the inisev_…

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00611 Published 2023-07-28 No fix listed CWE-352