Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

2 records

Vendor: shapedplugin Component: Logo Carousel Clear all filters
TI-2021-07021 CVE-2021-24739 · GHSA-25jm-89cm-8q44

Logo Carousel < 3.4.2 - Unauthorised Private Post Access

Priority LOW 37

The Logo Carousel WordPress plugin before 3.4.2 allows users with a role as low as Contributor to duplicate and view arbitrary private posts made by other users via the Carousel Duplication feature

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.01039 Published 2021-12-21 Fixed in 3.4.2 CWE-639
TI-2021-07020 CVE-2021-24738 · GHSA-jm24-qrrg-77rv

Logo Carousel < 3.4.2 - Contributor+ Stored Cross-Site Scripting

Priority LOW 25

The Logo Carousel WordPress plugin before 3.4.2 does not validate and escape the "Logo Margin" carousel option, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00624 Published 2021-12-21 Fixed in 3.4.2 CWE-79