Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: Awin Data Feed 1.8 Clear all filters
TI-2022-01797 CVE-2022-1938 · GHSA-9xww-pc5r-jrpc

Awin Data Feed < 1.8 - Unauthenticated Stored Cross-Site Scripting

Priority LOW 26

The Awin Data Feed WordPress plugin before 1.8 does not sanitise and escape a header when processing request to generate analytics data, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks again…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00729 Published 2022-07-11 Fixed in 1.8 CWE-79
TI-2022-01796 CVE-2022-1937 · GHSA-24x9-9gx2-3g25

Awin Data Feed < 1.8 - Reflected Cross-Site Scripting

Priority LOW 31

The Awin Data Feed WordPress plugin before 1.8 does not sanitise and escape a parameter before outputting it back via an AJAX action (available to both unauthenticated and authenticated users), leading to a Reflected Cro…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01833 Published 2022-07-11 Fixed in 1.8 CWE-79