Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

10 records

Vendor: VeronaLabs Component: Wp Sms Clear all filters
TI-2024-23098 CVE-2024-34811 · GHSA-32q4-6g3f-wq36

WordPress WP SMS plugin <= 6.5.1 - Cross Site Scripting (XSS) vulnerability

Priority LOW 27

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VeronaLabs WP SMS allows Stored XSS.This issue affects WP SMS: from n/a through 6.5.1.

CVSS 3.1MEDIUM 5.9 Network High privileges User interaction EPSS 0.00418 Published 2024-05-13 No fix listed CWE-79
TI-2024-17020 CVE-2024-25920 · GHSA-95cq-m3g2-g9qh

WordPress WP SMS plugin <= 6.3.4 - Cross Site Scripting (XSS) vulnerability

Priority LOW 29

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VeronaLabs WP SMS allows Stored XSS.This issue affects WP SMS: from n/a through 6.3.4.

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00317 Published 2024-03-27 No fix listed CWE-79
TI-2024-16395 CVE-2024-24881 · GHSA-jcfq-f3pm-f9px

WordPress WP SMS Plugin <= 6.5.2 is vulnerable to Cross Site Scripting (XSS)

Priority LOW 31

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VeronaLabs WP SMS – Messaging & SMS Notification for WordPress, WooCommerce, GravityForms, etc allows Reflected XSS.Th…

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00375 Published 2024-02-08 No fix listed CWE-79
TI-2023-06382 CVE-2023-6981 · GHSA-q2g5-wh6f-x8q9

WP SMS <= 6.5 - Authenticated (Admin+) SQL Injection to Reflected Cross-Site Scripting

Priority LOW 27

The WP SMS – Messaging & SMS Notification for WordPress, WooCommerce, GravityForms, etc plugin for WordPress is vulnerable to SQL Injection via the 'group_id' parameter in all versions up to, and including, 6.5 due to in…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00411 Published 2024-01-03 No fix listed CWE-89
TI-2023-06381 CVE-2023-6980 · GHSA-927j-v4r3-3qjf

WP SMS <= 6.5 - Cross-Site Request Forgery to Subscriber Deletion

Priority LOW 20

The WP SMS – Messaging & SMS Notification for WordPress, WooCommerce, GravityForms, etc plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.5.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00248 Published 2024-01-03 No fix listed CWE-352
TI-2023-12179 CVE-2023-27447 · GHSA-jf57-3c97-v2x5

WordPress WP SMS Plugin <= 6.0.4 is vulnerable to Sensitive Data Exposure

Priority LOW 34

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in VeronaLabs WP SMS – Messaging & SMS Notification for WordPress, WooCommerce, GravityForms, etc.This issue affects WP SMS – Messaging & SMS Notif…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00536 Published 2023-12-28 No fix listed CWE-200
TI-2021-06846 CVE-2021-24561 · GHSA-3hc7-7vjp-8x77

WP SMS < 5.4.13 - Authenticated Stored Cross-Site Scripting

Priority LOW 26

The WP SMS WordPress plugin before 5.4.13 does not sanitise the "wp_group_name" parameter before outputting it back in the "Groups" page, leading to an Authenticated Stored Cross-Site Scripting issue

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00671 Published 2021-08-23 Fixed in 5.4.13 CWE-79