Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Vendor: Ffw Clear all filters
TI-2021-07299 CVE-2021-25021 · GHSA-w8vh-gv77-c8pw

OMGF < 4.5.12 - Admin+ Arbitrary Folder Deletion via Path Traversal

Priority LOW 25

The OMGF | Host Google Fonts Locally WordPress plugin before 4.5.12 does not validate the cache directory setting, allowing high privilege users to use a path traversal vector and delete arbitrary folders when uninstalli…

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.01055 Published 2022-01-03 Fixed in 4.5.12 CWE-22
TI-2021-06922 CVE-2021-24639 · GHSA-9w5p-x556-4j8v

OMGF < 4.5.4 - Subscriber+ Arbitrary File/Folder Deletion

Priority LOW 37

The OMGF WordPress plugin before 4.5.4 does not enforce path validation, authorisation and CSRF checks in the omgf_ajax_empty_dir AJAX action, which allows any authenticated users to delete arbitrary files or folders on…

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00912 Published 2021-09-20 Fixed in 4.5.4 CWE-22
TI-2021-06921 CVE-2021-24638 · GHSA-728f-qcc4-8q48

OMGF < 4.5.4 - Unauthenticated Path Traversal in REST API

Priority MEDIUM 43

The OMGF WordPress plugin before 4.5.4 does not escape or validate the handle parameter of the REST API, which allows unauthenticated users to perform path traversal and overwrite arbitrary CSS file with Google Fonts CSS…

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.01821 Published 2021-09-20 Fixed in 4.5.4 CWE-22