Vulnerabilities

TI-2023-04827 CVE-2023-5251 · GHSA-cxcr-4mx7-3jpm

Grid Plus <= 1.3.2 - Missing Authorization to Authenticated (Subscriber+) Grid Layout Add/Update/Delete

LOW 25

The Grid Plus plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing capability check on the 'grid_plus_save_layout_callback' and 'grid_plus_delete_callback' functions i…

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00581 Published 2023-10-30 No fix listed CWE-862

TI-2023-04826 CVE-2023-5250 · GHSA-5g3f-8396-pv8p

Grid Plus <= 1.3.3 - Authenticated (Subscriber+) Local File Inclusion via Shortcode

MEDIUM 41

The Grid Plus plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 1.3.3 via a shortcode attribute.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01314 Published 2023-10-30 No fix listed CWE-98

Vulnerabilities

Filters

Grid Plus <= 1.3.2 - Missing Authorization to Authenticated (Subscriber+) Grid Layout Add/Update/Delete

Grid Plus <= 1.3.3 - Authenticated (Subscriber+) Local File Inclusion via Shortcode