Vulnerabilities

TI-2025-00873 CVE-2025-1033 · GHSA-w7g5-m4q3-r22v

Badgearoo <= 1.0.14 - Admin+ Stored XSS

MEDIUM 55

The Badgearoo WordPress plugin through 1.0.14 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltere…

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00287 Published 2025-05-15 No fix listed CWE-79

TI-2024-12852 CVE-2024-13828 · GHSA-xw9h-x6h4-fc8r

Badgearoo <= 1.0.14 - Reflected XSS

MEDIUM 60

The Badgearoo WordPress plugin through 1.0.14 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users s…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.0034 Published 2025-05-15 No fix listed CWE-79

TI-2023-15430 CVE-2023-32127 · GHSA-3c99-g4qv-p9wq

WordPress Multi Rating plugin <= 5.0.6 - Unauth Arbitrary rating value change

LOW 24

Missing Authorization vulnerability in Daniel Powney Multi Rating allows Functionality Misuse.This issue affects Multi Rating: from n/a through 5.0.6.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00424 Published 2024-04-24 No fix listed CWE-862

TI-2023-15428 CVE-2023-32125 · GHSA-j28c-2mmq-8j4f

WordPress Multi Rating Plugin <= 5.0.6 is vulnerable to Cross Site Request Forgery (CSRF)

MEDIUM 40

Cross-Site Request Forgery (CSRF) vulnerability in Daniel Powney Multi Rating plugin <= 5.0.6 versions.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00312 Published 2023-11-09 No fix listed CWE-352

TI-2023-15433 CVE-2023-32130 · GHSA-rwh9-5jcm-w345

WordPress Multi Rating Plugin <= 5.0.6 is vulnerable to Cross Site Scripting (XSS)

LOW 27

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Daniel Powney Multi Rating plugin <= 5.0.6 versions.

CVSS 3.1MEDIUM 5.9 Network High privileges User interaction EPSS 0.00369 Published 2023-08-18 No fix listed CWE-79

TI-2022-23510 CVE-2022-47433 · GHSA-8j8f-cx8f-89mc

WordPress Multi Rating Plugin <= 5.0.5 is vulnerable to Cross Site Scripting (XSS)

LOW 31

Unauth. Reflected Cross-Site Scripting vulnerability in Daniel Powney Multi Rating plugin <= 5.0.5 versions.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00382 Published 2023-03-29 No fix listed CWE-79

TI-2022-23520 CVE-2022-47443 · GHSA-8rgr-f33p-72v4

WordPress Multi Rating Plugin <= 5.0.5 is vulnerable to Cross Site Request Forgery (CSRF)

LOW 38

Cross-Site Request Forgery (CSRF) vulnerability in Daniel Powney Multi Rating plugin <= 5.0.5 versions.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00326 Published 2023-03-14 No fix listed CWE-352