Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: Discy 5.2 Clear all filters
TI-2022-01303 CVE-2022-1422 · GHSA-fg3m-42wq-h6wj

Discy < 5.2 - Restore Default Settings via CSRF

Priority LOW 30

The Discy WordPress theme before 5.2 does not check for CSRF tokens in the AJAX action discy_reset_options, allowing an attacker to trick an admin into resetting the site settings back to defaults.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00542 Published 2022-06-06 Fixed in 5.2 CWE-352
TI-2022-01302 CVE-2022-1421 · GHSA-mpq8-cm6q-wpq8

Discy < 5.2 - Settings Update via CSRF

Priority LOW 23

The Discy WordPress theme before 5.2 lacks CSRF checks in some AJAX actions, allowing an attacker to make a logged in admin change arbitrary 's settings including payment methods via a CSRF attack

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.01316 Published 2022-06-06 Fixed in 5.2 CWE-352