Vulnerabilities

TI-2023-03462 CVE-2023-3706 · GHSA-mc66-gqxj-pwmg

ActivityPub for WordPress < 1.0.0 - Subscriber+ Arbitrary Post Title Disclosure

MEDIUM 53

The ActivityPub WordPress plugin before 1.0.0 does not ensure that post titles to be displayed are public and belong to the plugin, allowing any authenticated user, such as subscriber to retrieve the title of arbitrary p…

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.0057 Published 2023-10-16 Fixed in 1.0.0

TI-2023-03499 CVE-2023-3746 · GHSA-32jc-368c-fvg6

ActivityPub for WordPress < 1.0.1 - Contributor+ Stored XSS

MEDIUM 58

The ActivityPub WordPress plugin before 1.0.0 does not sanitize and escape some data from post content, which could allow contributor and above role to perform Stored Cross-Site Scripting attacks

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.005 Published 2023-10-16 Fixed in 1.0.0

TI-2023-04657 CVE-2023-5057 · GHSA-rcgg-pr6j-3pmh

ActivityPub for WordPress < 1.0.0 - Contributor+ Stored XSS

LOW 25

The ActivityPub WordPress plugin before 1.0.0 does not escape user metadata before outputting them in mentions, which could allow users with a role of Contributor and above to perform Stored XSS attacks

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.0049 Published 2023-10-16 Fixed in 1.0.0

TI-2023-03463 CVE-2023-3707 · GHSA-2cc2-mcjj-r4mp

ActivityPub for WordPress < 1.0.0 - Subscriber+ Arbitrary Post Content Disclosure