Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

9 records

Vendor: pluginbuilders Component: Yourchannel Clear all filters
TI-2023-01756 CVE-2023-1869 · GHSA-r6p9-mgqc-wrwp

YourChannel <= 1.2.5 - Authenticated (Administrator+) Stored Cross-Site Scripting

Priority LOW 25

The YourChannel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 1.2.5 due to insufficient input sanitization and output escaping.

CVSS 3.1MEDIUM 5.5 Network High privileges No interaction EPSS 0.00482 Published 2023-04-05 No fix listed CWE-79
TI-2023-01755 CVE-2023-1868 · GHSA-2779-qh7w-73rg

YourChannel <= 1.2.3 - Missing Authorization to Plugin Cache Reset

Priority LOW 36

The YourChannel plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check when clearing the plugin cache via the yrc_clear_cache GET parameter in versions up to, and including, 1.2…

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00615 Published 2023-04-05 No fix listed CWE-862
TI-2023-01752 CVE-2023-1865 · GHSA-5c8g-9448-5x46

YourChannel <= 1.2.3 - Missing Authorization to Plugin Settings Reset

Priority LOW 36

The YourChannel plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check when resetting plugin settings via the yrc_nuke GET parameter in versions up to, and including, 1.2.3.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00705 Published 2023-04-05 No fix listed CWE-862
TI-2023-00267 CVE-2023-0282 · GHSA-x28p-2rmr-cx3p

YourChannel < 1.2.2 - Subscriber+ Stored XSS

Priority MEDIUM 58

The YourChannel WordPress plugin before 1.2.2 does not sanitize and escape some parameters, which could allow users with a role as low as Subscriber to perform Cross-Site Scripting attacks.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.0051 Published 2023-02-06 Fixed in 1.2.2
TI-2022-04429 CVE-2022-4833 · GHSA-w5hq-mq5m-5f94

YourChannel: Everything you want in a YouTube plugin < 1.2.3 - Contributor+ Stored XSS via Shortcode

Priority MEDIUM 58

The YourChannel: Everything you want in a YouTube plugin WordPress plugin before 1.2.3 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.0055 Published 2023-02-06 Fixed in 1.2.3