Vulnerabilities

TI-2021-07213 CVE-2021-24934 · GHSA-7579-2v4g-9grv

Visual CSS Style Editor < 7.5.4 - Reflected Cross-Site Scripting

LOW 30

The Visual CSS Style Editor WordPress plugin before 7.5.4 does not sanitise and escape the wyp_page_type parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting issue

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01397 Published 2022-02-01 Fixed in 7.5.4 CWE-79

TI-2019-08912 CVE-2019-11886 · GHSA-hrmr-jgrx-82h5

The WaspThemes Visual CSS Style Editor (aka yellow-pencil-visual-theme-customizer) plugin…

MEDIUM 42

The WaspThemes Visual CSS Style Editor (aka yellow-pencil-visual-theme-customizer) plugin before 7.2.1 for WordPress allows yp_option_update CSRF, as demonstrated by use of yp_remote_get to obtain admin access.

CVSS 3.0HIGH 8.8 Network No auth User interaction EPSS 0.02281 Published 2019-05-13 No fix listed CWE-352

Vulnerabilities

Filters

Visual CSS Style Editor < 7.5.4 - Reflected Cross-Site Scripting

The WaspThemes Visual CSS Style Editor (aka yellow-pencil-visual-theme-customizer) plugin…