Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

3 records

Vendor: INFINITUM FORM Component: Geo Controller Clear all filters
TI-2024-06841 CVE-2024-7381 · GHSA-4q7x-mgpp-gv6h

Geo Controller <= 8.6.9 - Missing Authorization to Unauthenticated Shortcode Execution

Priority LOW 26

The Geo Controller plugin for WordPress is vulnerable to unauthorized shortcode execution due to missing authorization and capability checks on the ajax__shortcode_cache function in all versions up to, and including, 8.6…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00336 Published 2024-09-05 No fix listed CWE-862
TI-2024-06840 CVE-2024-7380 · GHSA-hffc-gcjh-mj4f

Geo Controller <= 8.7.3 - Missing Authorization to Authenticated (Subscriber+) Menu Creation/Deletion

Priority LOW 20

The Geo Controller plugin for WordPress is vulnerable to unauthorized menu creation/deletion due to missing capability checks on the ajax__geolocate_menu and ajax__geolocate_remove_menu functions in all versions up to, a…

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00264 Published 2024-09-05 No fix listed CWE-862
TI-2024-03346 CVE-2024-3591 · GHSA-j9wj-h588-6g73

WordPress Geo Controller < 8.6.5 - PHP Object Injection

Priority HIGH 68

The Geo Controller WordPress plugin before 8.6.5 unserializes user input via some of its AJAX actions and REST API routes, which could allow unauthenticated users to perform PHP Object Injection when a suitable gadget is…

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00489 Published 2024-05-01 Fixed in 8.6.5 CWE-502