Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

4 records

Vendor: Salephpscripts Component: Web Directory Free Clear all filters
TI-2024-03427 CVE-2024-3673 · GHSA-8pqc-xcjc-j8v3

Web Directory Free < 1.7.3 - Unauthenticated LFI

Priority HIGH 78

The Web Directory Free WordPress plugin before 1.7.3 does not validate a parameter before using it in an include(), which could lead to Local File Inclusion issues.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.05578 Published 2024-08-30 Fixed in 1.7.3
TI-2024-03423 CVE-2024-3669 · GHSA-7jw8-q7xc-w2cq

Web Directory Free < 1.7.2 - Reflected XSS

Priority MEDIUM 63

The Web Directory Free WordPress plugin before 1.7.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege…

CVSS 3.1MEDIUM 6.8 Network Low privileges User interaction EPSS 0.00501 Published 2024-07-30 Fixed in 1.7.2 CWE-79
TI-2024-03312 CVE-2024-3552 · GHSA-jwg5-qqgr-9462

Web Directory Free < 1.7.0 - Unauthenticated SQL Injection

Priority CRITICAL 85

The Web Directory Free WordPress plugin before 1.7.0 does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection with diff…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.6706 Published 2024-06-13 Fixed in 1.7.0 CWE-89
TI-2023-02064 CVE-2023-2201 · GHSA-7jgf-cw25-29f2

Web Directory Free <= 1.6.8 - Authenticated (Contributor+) SQL Injection via post_id

Priority MEDIUM 42

The Web Directory Free for WordPress is vulnerable to SQL Injection via the ‘post_id’ parameter in versions up to, and including, 1.6.8 due to insufficient escaping on the user supplied parameter and lack of sufficient p…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00815 Published 2023-06-02 No fix listed CWE-89