Vulnerabilities

TI-2024-23618 CVE-2024-35749 · GHSA-hgwf-5rc9-7vr3

WordPress Under Construction / Maintenance Mode from Acurax plugin <= 2.6 - IP Bypass vulnerability

LOW 24

Authentication Bypass by Spoofing vulnerability in Acurax Under Construction / Maintenance Mode from Acurax allows Authentication Bypass.This issue affects Under Construction / Maintenance Mode from Acurax: from n/a thro…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00297 Published 2024-06-10 No fix listed CWE-290

TI-2024-01378 CVE-2024-1476 · GHSA-j4r6-g8mv-35vf

Under Construction / Maintenance Mode from Acurax <= 2.6 - Information Exposure

LOW 31

The Under Construction / Maintenance Mode from Acurax plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.6 via the REST API.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00475 Published 2024-02-28 No fix listed CWE-284

TI-2023-06325 CVE-2023-6922 · GHSA-3r9p-rc57-36hr

Under Construction / Maintenance Mode from Acurax <= 2.6 - Authenticated (Subscriber+) Sensitive Information Exposure

LOW 29

The Under Construction / Maintenance Mode from Acurax plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 2.6 via the 'acx_csma_subscribe_ajax' function.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00494 Published 2024-02-28 No fix listed CWE-200

TI-2023-20825 CVE-2023-39926 · GHSA-qh33-c8m9-ggwr

WordPress Under Construction / Maintenance Mode from Acurax Plugin <= 2.6 is vulnerable to Cross Site Scripting (XSS)

MEDIUM 64

Unauth. Stored Cross-Site Scripting (XSS) vulnerability in Acurax Under Construction / Maintenance Mode from Acurax plugin <= 2.6 versions.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00412 Published 2023-11-16 No fix listed CWE-79

TI-2021-14941 CVE-2021-36843 · GHSA-hw2w-x847-8444

WordPress Floating Social Media Icon plugin <= 4.3.5 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

LOW 23

Authenticated Stored Cross-Site Scripting (XSS) vulnerability discovered in WordPress Floating Social Media Icon plugin (versions <= 4.3.5) Social Media Configuration form.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00573 Published 2021-11-26 No fix listed CWE-79

TI-2018-04679 CVE-2018-6357 · GHSA-7v6m-79qx-mc6q

The acx_asmw_saveorder_callback function in function.php in the…

LOW 39

The acx_asmw_saveorder_callback function in function.php in the acurax-social-media-widget plugin before 3.2.6 for WordPress has CSRF via the recordsArray parameter to wp-admin/admin-ajax.php, with resultant social_widge…

CVSS 3.0HIGH 8.8 Network No auth User interaction EPSS 0.00649 Published 2018-01-27 No fix listed CWE-352