Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

5 records

Vendor: Wow-Company Component: Wp Coder Clear all filters
TI-2024-02398 CVE-2024-2578 · GHSA-xph7-pm58-q56v

WordPress WP Coder plugin <= 3.5 - Cross Site Scripting (XSS) vulnerability

Priority LOW 26

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPCoder WP Coder allows Stored XSS.This issue affects WP Coder: from n/a through 3.5.

CVSS 3.1MEDIUM 5.9 Network High privileges User interaction EPSS 0.00316 Published 2024-03-21 No fix listed CWE-79
TI-2023-02217 CVE-2023-2362 · GHSA-vx6w-q89v-7755

Multiple Plugins from Wow-Company - Reflected XSS

Priority MEDIUM 60

The Float menu WordPress plugin before 5.0.2, Bubble Menu WordPress plugin before 3.0.4, Button Generator WordPress plugin before 2.3.5, Calculator Builder WordPress plugin before 1.5.1, Counter Box WordPress plugin befo…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00458 Published 2023-06-12 Fixed in 5.0.2, 3.0.4 +9
TI-2023-00847 CVE-2023-0895 · GHSA-m2hp-qjqj-65cw

WP Coder – add custom html, css and js code <= 2.5.3 - Authenticated (Admin+) SQL Injection

Priority LOW 35

The WP Coder – add custom html, css and js code plugin for WordPress is vulnerable to time-based SQL Injection via the ‘id’ parameter in versions up to, and including, 2.5.3 due to insufficient escaping on the user suppl…

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00798 Published 2023-02-17 No fix listed CWE-89
TI-2022-02204 CVE-2022-2388 · GHSA-3v49-f236-jv89

WP Coder < 2.5.3 - Code Deletion via CSRF

Priority LOW 29

The WP Coder WordPress plugin before 2.5.3 does not have CSRF check in place when deleting code created by the plugin, which could allow attackers to make a logged in admin delete arbitrary ones via a CSRF attack

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00438 Published 2022-08-22 Fixed in 2.5.3 CWE-352
TI-2021-07331 CVE-2021-25053 · GHSA-pw9r-237f-q334

WP Coder < 2.5.2 - RFI leading to RCE via CSRF

Priority LOW 39

The WP Coder WordPress plugin before 2.5.2 within the wow-company admin menu page allows to include() arbitrary file with PHP extension (as well as with data:// or http:// protocols), thus leading to CSRF RCE.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00692 Published 2022-01-10 Fixed in 2.5.2 CWE-352