Vulnerabilities

TI-2019-12263 CVE-2019-16289 · GHSA-56v5-5hhr-c693

The insert-php (aka Woody ad snippets) plugin before 2.2.8 for WordPress allows…

LOW 26

The insert-php (aka Woody ad snippets) plugin before 2.2.8 for WordPress allows authenticated XSS via the winp_item parameter.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.01028 Published 2019-09-13 No fix listed CWE-79

TI-2019-11919 CVE-2019-15858 · GHSA-q88p-g94x-r7pc

admin/includes/class.import.snippet.php in the "Woody ad snippets" plugin before 2.2.5…

MEDIUM 57

admin/includes/class.import.snippet.php in the "Woody ad snippets" plugin before 2.2.5 for WordPress allows unauthenticated options import, as demonstrated by storing an XSS payload for remote code execution.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.19967 Published 2019-09-03 No fix listed CWE-306

TI-2019-10983 CVE-2019-14773 · GHSA-fjqg-gqf9-43m4

admin/includes/class.actions.snippet.php in the "Woody ad snippets" plugin through 2.2.5…

LOW 36

admin/includes/class.actions.snippet.php in the "Woody ad snippets" plugin through 2.2.5 for WordPress allows wp-admin/admin-post.php?action=close&post= deletion.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.0163 Published 2019-08-08 No fix listed

Vulnerabilities

Filters

The insert-php (aka Woody ad snippets) plugin before 2.2.8 for WordPress allows…

admin/includes/class.import.snippet.php in the "Woody ad snippets" plugin before 2.2.5…

admin/includes/class.actions.snippet.php in the "Woody ad snippets" plugin through 2.2.5…