Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Vendor: Amini7 Clear all filters
TI-2024-12585 CVE-2024-13544 · GHSA-9m2c-327v-gghq

Zarinpal Paid Downloads <= 2.3 - Admin+ Arbitrary File Upload

Priority MEDIUM 55

The Zarinpal Paid Download WordPress plugin through 2.3 does not properly validate uploaded files, allowing high privilege users such as admin to upload arbitrary files on the server even when they should not be allowed…

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00333 Published 2025-02-11 No fix listed CWE-434
TI-2024-12584 CVE-2024-13543 · GHSA-9fmx-g36w-qhc9

Zarinpal Paid Downloads <= 2.3 - Reflected XSS

Priority MEDIUM 60

The Zarinpal Paid Download WordPress plugin through 2.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privile…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00587 Published 2025-02-11 No fix listed CWE-79