Vulnerabilities

TI-2023-02805 CVE-2023-2995 · GHSA-6vm8-mfgv-3gj5

Leyka < 3.30.4 - Admin+ Stored XSS

MEDIUM 55

The Leyka WordPress plugin before 3.30.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_htm…

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00448 Published 2023-09-19 Fixed in 3.30.4

TI-2023-04528 CVE-2023-4917 · GHSA-44r8-jfrv-4f7w

Leyka <= 3.30.7 - Authenticated (Subscriber+) Sensitive Information Exposure

LOW 30

The Leyka plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 3.30.7 via the 'leyka_ajax_get_env_and_options' function.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00752 Published 2023-09-13 No fix listed CWE-200

TI-2023-16484 CVE-2023-33325 · GHSA-fm6h-vprp-93mv

WordPress Leyka Plugin <= 3.30.1 is vulnerable to Cross Site Scripting (XSS)

LOW 31

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Teplitsa of social technologies Leyka plugin <= 3.30.1 versions.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00382 Published 2023-08-30 No fix listed CWE-79

TI-2023-20457 CVE-2023-39314 · GHSA-5rwc-67gj-5769

WordPress Leyka Plugin <= 3.30.2 is vulnerable to Cross Site Scripting (XSS)

LOW 31

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Teplitsa of social technologies Leyka plugin <= 3.30.2 versions.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.0039 Published 2023-08-10 No fix listed CWE-79

TI-2023-12182 CVE-2023-27450 · GHSA-w3v6-87v7-hwfq

WordPress Leyka Plugin <= 3.29.2 is vulnerable to Cross Site Scripting (XSS)

LOW 31

Unauth. Stored Cross-Site Scripting (XSS) vulnerability in Teplitsa of social technologies Leyka plugin <= 3.29.2 versions.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00382 Published 2023-06-21 No fix listed CWE-79

Vulnerabilities

Filters

Leyka < 3.30.4 - Admin+ Stored XSS

Leyka <= 3.30.7 - Authenticated (Subscriber+) Sensitive Information Exposure

WordPress Leyka Plugin <= 3.30.1 is vulnerable to Cross Site Scripting (XSS)

WordPress Leyka Plugin <= 3.30.2 is vulnerable to Cross Site Scripting (XSS)

WordPress Leyka Plugin <= 3.29.2 is vulnerable to Cross Site Scripting (XSS)