Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

6 records

Vendor: draftpress Clear all filters
TI-2024-03076 CVE-2024-3280 · GHSA-p7qx-x6gw-cw9m

Cross-site scripting in draftpress Follow Us Badges

Priority LOW 28

The Follow Us Badges plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpsite_follow_us_badges shortcode in all versions up to, and including, 3.1.10 due to insufficient input sanitizatio…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00324 Published 2024-05-02 No fix listed CWE-79
TI-2022-00803 CVE-2022-0899 · GHSA-578w-8w42-q6vh

Header Footer Code Manager < 1.1.24 - Reflected Cross-Site Scripting

Priority LOW 30

The Header Footer Code Manager WordPress plugin before 1.1.24 does not escape generated URLs before outputting them back in attributes in an admin page, leading to a Reflected Cross-Site Scripting.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01284 Published 2022-07-25 Fixed in 1.1.24 CWE-79
TI-2022-00624 CVE-2022-0710 · GHSA-x9vf-vfg5-v2m7

Header Footer Code Manager <= 1.1.16 Reflected XSS

Priority LOW 32

The Header Footer Code Manager plugin <= 1.1.16 for WordPress is vulnerable to Reflected Cross-Site Scripting (XSS) via the $_REQUEST['page'] parameter.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.02416 Published 2022-02-24 No fix listed CWE-79
TI-2021-07073 CVE-2021-24791 · GHSA-2j37-h336-4w29

Header Footer Code Manager < 1.1.14 - Admin+ SQL Injections

Priority MEDIUM 40

The Header Footer Code Manager WordPress plugin before 1.1.14 does not validate and escape the "orderby" and "order" request parameters before using them in a SQL statement when viewing the Snippets admin dashboard, lead…

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.05208 Published 2021-11-08 Fixed in 1.1.14 CWE-89
TI-2021-06735 CVE-2021-24445 · GHSA-9x8r-8v3j-4x8m

My Site Audit <= 1.2.4 - Authenticated Stored Cross-Site Scripting (XSS)

Priority LOW 26

The My Site Audit WordPress plugin through 1.2.4 does not sanitise or escape the Audit Name field when creating an audit, allowing high privilege users to set JavaScript payloads in them, even when he unfiltered_html cap…

CVSS 3.1MEDIUM 5.5 Network High privileges No interaction EPSS 0.00656 Published 2021-08-16 No fix listed CWE-79