Vulnerabilities

TI-2024-01036 CVE-2024-1118 · GHSA-phfx-2gmw-mfx5

Podlove Subscribe button <= 1.3.10 - Authenticated (Contributor+) SQL Injection

LOW 39

The Podlove Subscribe button plugin for WordPress is vulnerable to UNION-based SQL Injection via the 'button' attribute of the podlove-subscribe-button shortcode in all versions up to, and including, 1.3.10 due to insuff…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00652 Published 2024-02-07 No fix listed CWE-89

TI-2023-10791 CVE-2023-25481 · GHSA-44m5-fc9p-4q7r

WordPress Podlove Subscribe button Plugin <= 1.3.7 is vulnerable to Cross Site Request Forgery (CSRF)

LOW 38

Cross-Site Request Forgery (CSRF) vulnerability in Podlove Podlove Subscribe button plugin <= 1.3.7 versions.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00248 Published 2023-05-23 No fix listed CWE-352

TI-2023-10789 CVE-2023-25479 · GHSA-qr78-7vm9-2fj7

WordPress Podlove Subscribe button Plugin <= 1.3.7 is vulnerable to Cross Site Scripting (XSS)

LOW 27

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Podlove Podlove Subscribe button plugin <= 1.3.7 versions.

CVSS 3.1MEDIUM 5.9 Network High privileges User interaction EPSS 0.00369 Published 2023-04-25 No fix listed CWE-79

Vulnerabilities

Filters

Podlove Subscribe button <= 1.3.10 - Authenticated (Contributor+) SQL Injection

WordPress Podlove Subscribe button Plugin <= 1.3.7 is vulnerable to Cross Site Request Forgery (CSRF)

WordPress Podlove Subscribe button Plugin <= 1.3.7 is vulnerable to Cross Site Scripting (XSS)