Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

5 records

Vendor: Popozure Component: Pz-linkcard Clear all filters
TI-2024-00624 CVE-2024-0677 · GHSA-9q54-pg8p-25cg

Pz-LinkCard <= 2.5.1 - Contributor+ SSRF

Priority MEDIUM 56

The Pz-LinkCard WordPress plugin through 2.5.1 does not prevent users from pinging arbitrary hosts via some of its shortcodes, which could allow high privilege users such as contributors to perform SSRF attacks.

CVSS 3.1MEDIUM 5.1 Local High privileges No interaction EPSS 0.00263 Published 2024-03-28 No fix listed CWE-918
TI-2024-00620 CVE-2024-0673 · GHSA-fpr2-hvvq-5xh8

Pz-LinkCard <= 2.5.1 - Admin+ Stored XSS

Priority MEDIUM 60

The Pz-LinkCard WordPress plugin through 2.5.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00467 Published 2024-03-28 No fix listed CWE-79
TI-2024-00619 CVE-2024-0672 · GHSA-5w42-fg4v-hv3r

Pz-LinkCard <= 2.5.1 - Reflected XSS

Priority MEDIUM 64

The Pz-LinkCard WordPress plugin through 2.5.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users…

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00491 Published 2024-03-28 No fix listed CWE-79
TI-2021-07290 CVE-2021-25012 · GHSA-8xqr-mvwg-chr4

Pz-LinkCard <= 2.4.4.4 - Reflected Cross-Site Scripting

Priority LOW 29

The Pz-LinkCard WordPress plugin through 2.4.4.4 does not sanitise and escape multiple parameters before outputting them back in admin dashboard pages, leading to Reflected Cross-Site Scripting issues

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.008 Published 2022-03-28 No fix listed CWE-79