Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: WPQA Builder Plugin 5.2 Clear all filters
TI-2022-01306 CVE-2022-1425 · GHSA-r5pq-3cxr-5rmc

WPQA < 5.2 - Subscriber+ Private Message Disclosure via IDOR

Priority LOW 21

The WPQA Builder Plugin WordPress plugin before 5.2, used as a companion plugin for the Discy and Himer , does not validate that the message_id of the wpqa_message_view ajax action belongs to the requesting user, leading…

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00799 Published 2022-05-16 Fixed in 5.2 CWE-639
TI-2022-01231 CVE-2022-1349 · GHSA-mfhm-pr46-c4c3

WPQA < 5.2 - Subscriber+ Arbitrary Profile Picture Deletion via IDOR

Priority LOW 21

The WPQA Builder Plugin WordPress plugin before 5.2, used as a companion plugin for the Discy and Himer , does not validate that the value passed to the image_id parameter of the ajax action wpqa_remove_image belongs to…

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00654 Published 2022-05-16 Fixed in 5.2 CWE-287
TI-2022-00948 CVE-2022-1051 · GHSA-p462-hx7j-6485

WPQA < 5.2 - Subscriber+ Stored Cross-Site Scripting via Profile fields

Priority LOW 27

The WPQA Builder Plugin WordPress plugin before 5.2, used as a companion plugin for the Discy and Himer , does not sanitise and escape the city, phone or profile credentials fields when outputting it in the profile page,…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.01291 Published 2022-05-16 Fixed in 5.2 CWE-79