Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

4 records

Vendor: draftpress Component: Header Footer Code Manager Clear all filters
TI-2022-00803 CVE-2022-0899 · GHSA-578w-8w42-q6vh

Header Footer Code Manager < 1.1.24 - Reflected Cross-Site Scripting

Priority LOW 30

The Header Footer Code Manager WordPress plugin before 1.1.24 does not escape generated URLs before outputting them back in attributes in an admin page, leading to a Reflected Cross-Site Scripting.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01284 Published 2022-07-25 Fixed in 1.1.24 CWE-79
TI-2022-00624 CVE-2022-0710 · GHSA-x9vf-vfg5-v2m7

Header Footer Code Manager <= 1.1.16 Reflected XSS

Priority LOW 32

The Header Footer Code Manager plugin <= 1.1.16 for WordPress is vulnerable to Reflected Cross-Site Scripting (XSS) via the $_REQUEST['page'] parameter.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.02416 Published 2022-02-24 No fix listed CWE-79
TI-2021-07073 CVE-2021-24791 · GHSA-2j37-h336-4w29

Header Footer Code Manager < 1.1.14 - Admin+ SQL Injections

Priority MEDIUM 40

The Header Footer Code Manager WordPress plugin before 1.1.14 does not validate and escape the "orderby" and "order" request parameters before using them in a SQL statement when viewing the Snippets admin dashboard, lead…

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.05208 Published 2021-11-08 Fixed in 1.1.14 CWE-89