Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

2 records

Vendor: specialk Component: Prismatic Clear all filters
TI-2021-06701 CVE-2021-24409 · GHSA-2r3g-9rm8-7fv3

Prismatic < 2.8 - Reflected Cross-Site Scripting (XSS)

Priority LOW 31

The Prismatic WordPress plugin before 2.8 does not escape the 'tab' GET parameter before outputting it back in an attribute, leading to a reflected Cross-Site Scripting issue which will be executed in the context of a lo…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01722 Published 2021-07-12 Fixed in 2.8 CWE-79
TI-2021-06700 CVE-2021-24408 · GHSA-vc6f-wccw-cfjq

Prismatic < 2.8 - Contributor+ Stored XSS

Priority LOW 25

The Prismatic WordPress plugin before 2.8 does not sanitise or validate some of its shortcode parameters, allowing users with a role as low as Contributor to set Cross-Site payload in them.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00624 Published 2021-07-12 Fixed in 2.8 CWE-79