Vulnerabilities

TI-2024-11677 CVE-2024-12585 · GHSA-p52h-3642-m4x3

PropertyHive < 2.1.1 - Reflected XSS

MEDIUM 60

The Property Hive WordPress plugin before 2.1.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00633 Published 2025-01-08 Fixed in 2.1.1 CWE-79

TI-2024-24719 CVE-2024-37204 · GHSA-m4vx-fw44-c9jg

WordPress PropertyHive plugin <= 2.0.9 - Broken Access Control vulnerability

LOW 20

Missing Authorization vulnerability in PropertyHive PropertyHive allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PropertyHive: from n/a through 2.0.9.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00392 Published 2024-11-01 No fix listed CWE-862

TI-2024-07872 CVE-2024-8490 · GHSA-jmwg-f97v-w7m5

PropertyHive <= 2.0.19 - Cross-Site Request Forgery via save_account_details

MEDIUM 40

The PropertyHive plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.19.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00353 Published 2024-09-17 No fix listed CWE-352

TI-2024-23570 CVE-2024-35701 · GHSA-f985-8pr4-6m53

WordPress PropertyHive plugin <= 2.0.13 - Cross Site Scripting (XSS) vulnerability

LOW 28

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in PropertyHive allows Stored XSS.This issue affects PropertyHive: from n/a through 2.0.13.

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00261 Published 2024-06-08 No fix listed CWE-79

TI-2024-22721 CVE-2024-34381 · GHSA-4qhm-36g2-5mv9

WordPress PropertyHive plugin <= 2.0.10 - Cross Site Scripting (XSS) vulnerability

LOW 29

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PropertyHive allows Stored XSS.This issue affects PropertyHive: from n/a through 2.0.10.

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00328 Published 2024-05-06 No fix listed CWE-79

TI-2024-03362 CVE-2024-3607 · GHSA-xcf2-9gfx-5x8f

PropertyHive <= 2.0.12 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion

LOW 21

The PropertyHive plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the delete_key_date() function in all versions up to, and including, 2.0.12.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00614 Published 2024-05-02 No fix listed CWE-862

TI-2024-19690 CVE-2024-29923 · GHSA-pgqq-jhj2-4x9h

WordPress PropertyHive plugin <= 2.0.8 - Reflected Cross Site Scripting (XSS) vulnerability

MEDIUM 64

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PropertyHive allows Reflected XSS.This issue affects PropertyHive: from n/a through 2.0.8.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00397 Published 2024-03-27 No fix listed CWE-79

TI-2024-16249 CVE-2024-24718 · GHSA-p29f-v46f-qrx3

WordPress PropertyHive plugin <= 2.0.6 - Missing Authorization to Non-Arbitrary Plugin Installation vulnerability

LOW 29

Missing Authorization vulnerability in PropertyHive.This issue affects PropertyHive: from n/a through 2.0.6.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00321 Published 2024-03-26 No fix listed CWE-862

TI-2024-18586 CVE-2024-27985 · GHSA-jjqv-cpg4-vp45

WordPress PropertyHive plugin <= 2.0.9 - PHP Object Injection vulnerability

MEDIUM 40

Deserialization of Untrusted Data vulnerability in PropertyHive.This issue affects PropertyHive: from n/a through 2.0.9.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00376 Published 2024-03-21 No fix listed CWE-502

TI-2024-15554 CVE-2024-23513 · GHSA-qv77-7528-4hgx

WordPress PropertyHive Plugin <= 2.0.5 is vulnerable to PHP Object Injection

MEDIUM 43

Deserialization of Untrusted Data vulnerability in PropertyHive.This issue affects PropertyHive: from n/a through 2.0.5.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00519 Published 2024-02-12 No fix listed CWE-502

TI-2023-08881 CVE-2023-22706 · GHSA-f7fj-3335-3232

WordPress PropertyHive Plugin <= 1.5.48 is vulnerable to Cross Site Scripting (XSS)

LOW 31

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in PropertyHive plugin <= 1.5.48 versions.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00382 Published 2023-05-15 No fix listed CWE-79

TI-2023-13603 CVE-2023-29172 · GHSA-4v7f-gpgp-5q79

WordPress PropertyHive Plugin <= 1.5.46 is vulnerable to Cross Site Scripting (XSS)

LOW 31

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in PropertyHive plugin <= 1.5.46 versions.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00382 Published 2023-04-07 No fix listed CWE-79

TI-2018-04751 CVE-2018-6465 · GHSA-r4jc-p365-xmq5

The PropertyHive plugin before 1.4.15 for WordPress has XSS via the body parameter to…

LOW 31

The PropertyHive plugin before 1.4.15 for WordPress has XSS via the body parameter to includes/admin/views/html-preview-applicant-matches-email.php.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.01623 Published 2018-01-31 No fix listed CWE-79

Vulnerabilities

Filters