Vulnerabilities

TI-2024-03682 CVE-2024-3944 · GHSA-q57h-cpxr-m8w6

WP To Do <= 1.3.0 - Authenticated (Admin+) Stored Cross-Site Scripting via Task Comments

LOW 22

The WP To Do plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment in all versions up to, and including, 1.3.0 due to insufficient input sanitization and output escaping.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00338 Published 2024-08-29 No fix listed CWE-79

TI-2024-25039 CVE-2024-37539 · GHSA-26rv-62pj-28w7

WordPress WP To Do plugin <= 1.3.0 - Cross Site Scripting (XSS) vulnerability

LOW 29

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Delower WP To Do allows Stored XSS.This issue affects WP To Do: from n/a through 1.3.0.

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00277 Published 2024-07-06 No fix listed CWE-79

TI-2024-03684 CVE-2024-3946

WP To Do <= 1.3.0 - Authenticated (Admin+) Stored Cross-Site Scripting via Settings

LOW 22

The WP To Do plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.3.0 due to insufficient input sanitization and output escaping.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00318 Published 2024-05-30 No fix listed CWE-79

TI-2024-03685 CVE-2024-3947

WP To Do <= 1.3.0 - Cross-Site Request Forgery via wptodo_settings

LOW 19

The WP To Do plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.0.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00222 Published 2024-05-30 No fix listed CWE-352

TI-2024-03683 CVE-2024-3945

WP To Do <= 1.3.0 - Cross-Site Request Forgery via wptodo_manage()

LOW 19

The WP To Do plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.0.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00222 Published 2024-05-30 No fix listed CWE-352

TI-2024-03681 CVE-2024-3943

WP To Do <= 1.3.0 - Cross-Site Request Forgery via wptodo_addcomment

LOW 19

The WP To Do plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.0.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00222 Published 2024-05-30 No fix listed CWE-352

TI-2024-14879 CVE-2024-22292 · GHSA-mxgp-w5v3-c946

WordPress WP To Do Plugin <= 1.2.8 is vulnerable to Cross Site Scripting (XSS)

LOW 29

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Delower WP To Do allows Stored XSS.This issue affects WP To Do: from n/a through 1.2.8.

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00317 Published 2024-01-31 No fix listed CWE-79

Vulnerabilities

Filters

WP To Do <= 1.3.0 - Authenticated (Admin+) Stored Cross-Site Scripting via Task Comments

WordPress WP To Do plugin <= 1.3.0 - Cross Site Scripting (XSS) vulnerability

WP To Do <= 1.3.0 - Authenticated (Admin+) Stored Cross-Site Scripting via Settings

WP To Do <= 1.3.0 - Cross-Site Request Forgery via wptodo_settings

WP To Do <= 1.3.0 - Cross-Site Request Forgery via wptodo_manage()

WP To Do <= 1.3.0 - Cross-Site Request Forgery via wptodo_addcomment

WordPress WP To Do Plugin <= 1.2.8 is vulnerable to Cross Site Scripting (XSS)