Vulnerabilities

TI-2024-06879 CVE-2024-7423 · GHSA-6f2c-7wmp-gmrf

Stream <= 4.0.1 - Cross-Site Request Forgery to Arbitrary Options Update

MEDIUM 40

The Stream plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.0.1.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.0033 Published 2024-09-13 No fix listed CWE-352

TI-2022-21242 CVE-2022-43450 · GHSA-3j4h-62vw-5645

WordPress Stream Plugin <= 3.9.2 is vulnerable to Insecure Direct Object References (IDOR)

LOW 30

Authorization Bypass Through User-Controlled Key vulnerability in XWP Stream.This issue affects Stream: from n/a through 3.9.2.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00652 Published 2023-12-19 No fix listed CWE-639

TI-2022-21279 CVE-2022-43490 · GHSA-fcr6-wjf5-jw82

WordPress Stream Plugin <= 3.9.2 is vulnerable to Cross Site Request Forgery (CSRF)

LOW 38

Cross-Site Request Forgery (CSRF) vulnerability in XWP Stream plugin <= 3.9.2 versions.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00264 Published 2023-05-25 No fix listed CWE-352

TI-2022-04015 CVE-2022-4384 · GHSA-frh4-4pfg-65vw

Stream < 3.9.2 - Subscriber+ Alert Creation

MEDIUM 62

The Stream WordPress plugin before 3.9.2 does not prevent users with little privileges on the site (like subscribers) from using its alert creation functionality, which may enable them to leak sensitive information.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.0091 Published 2023-02-06 Fixed in 3.9.2

TI-2021-07054 CVE-2021-24772 · GHSA-8h59-r32p-w7w3

Stream < 3.8.2 - Admin+ SQL Injection

MEDIUM 41

The Stream WordPress plugin before 3.8.2 does not sanitise and validate the order GET parameter from the Stream Records admin dashboard before using it in a SQL statement, leading to an SQL injection issue.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01554 Published 2021-11-17 Fixed in 3.8.2 CWE-89