Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
2 selected

2 records

Vendor: Riverforest-wp Component: Simple Blog Card Clear all filters
TI-2023-03744 CVE-2023-4035 · GHSA-8hw5-9v34-vmg4

Simple Blog Card < 1.31 - Contributor+ Stored XSS via Shortcode

Priority MEDIUM 58

The Simple Blog Card WordPress plugin before 1.31 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the co…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00433 Published 2023-08-30 Fixed in 1.31
TI-2023-03745 CVE-2023-4036 · GHSA-j874-rmjf-2w72

Simple Blog Card < 1.32 - Subscriber+ Arbitrary Post Access

Priority MEDIUM 53

The Simple Blog Card WordPress plugin before 1.32 does not ensure that posts to be displayed via a shortcode are public, allowing any authenticated users, such as subscriber, to retrieve arbitrary post title and their co…

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00553 Published 2023-08-30 Fixed in 1.32