Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

8 records

Vendor: Patreon Component: Patreon Wordpress Clear all filters
TI-2021-07304 CVE-2021-25026 · GHSA-84ph-h2vc-8hrg

Patreon WordPress < 1.8.2 - Admin+ Stored Cross-Site Scripting

Priority LOW 26

The Patreon WordPress plugin before 1.8.2 does not sanitise and escape the field "Custom Patreon Page name", which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html ca…

CVSS 3.1MEDIUM 5.5 Network High privileges No interaction EPSS 0.00699 Published 2022-03-14 Fixed in 1.8.2 CWE-79
TI-2021-06523 CVE-2021-24231 · GHSA-hhg9-2j57-c5cj

Patreon WordPress < 1.7.0 - CSRF to Disconnect Sites From Patreon

Priority LOW 30

The Jetpack Scan team identified a Cross-Site Request Forgery vulnerability in the Patreon WordPress plugin before 1.7.0, allowing attackers to make a logged administrator disconnect the site from Patreon by visiting a s…

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00575 Published 2021-04-12 Fixed in 1.7.0 CWE-352
TI-2021-06522 CVE-2021-24230 · GHSA-9pr2-6qr7-7436

Patreon WordPress < 1.7.0 - CSRF to Overwrite/Create User Meta

Priority LOW 36

The Jetpack Scan team identified a Cross-Site Request Forgery vulnerability in the Patreon WordPress plugin before 1.7.0, allowing attackers to make a logged in user overwrite or create arbitrary user metadata on the vic…

CVSS 3.1HIGH 8.1 Network No auth User interaction EPSS 0.00598 Published 2021-04-12 Fixed in 1.7.0 CWE-352
TI-2021-06520 CVE-2021-24228 · GHSA-3g9j-v8wq-8c77

Patreon WordPress < 1.7.2 - Reflected XSS on Login Form

Priority MEDIUM 45

The Jetpack Scan team identified a Reflected Cross-Site Scripting in the Login Form of the Patreon WordPress plugin before 1.7.2.

CVSS 3.1CRITICAL 9.6 Network No auth User interaction EPSS 0.01874 Published 2021-04-12 Fixed in 1.7.2 CWE-79
TI-2021-06519 CVE-2021-24227 · GHSA-cc3j-r9g7-4r8c

Patreon WordPress < 1.7.0 - Unauthenticated Local File Disclosure

Priority MEDIUM 42

The Jetpack Scan team identified a Local File Disclosure vulnerability in the Patreon WordPress plugin before 1.7.0 that could be abused by anyone visiting the site.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.06755 Published 2021-04-12 Fixed in 1.7.0 CWE-200