Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Vendor: Flat Preloader Project Clear all filters
TI-2021-07071 CVE-2021-24789 · GHSA-grw5-p86m-w8x6

Flat Preloader < 1.5.5 - Admin+ Stored Cross-Site Scripting

Priority LOW 23

The Flat Preloader WordPress plugin before 1.5.5 does not escape some of its settings when outputting them in attribute in the frontend, which could allow high privilege users to perform Cross-Site Scripting attacks even…

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00643 Published 2021-11-01 Fixed in 1.5.5 CWE-79
TI-2021-06967 CVE-2021-24685 · GHSA-3mcq-mff7-29h7

Flat Preloader < 1.5.4 - CSRF to Stored Cross-Site Scripting

Priority LOW 25

The Flat Preloader WordPress plugin before 1.5.4 does not enforce nonce checks when saving its settings, as well as does not sanitise and escape them, which could allow attackers to a make logged in admin change them wit…

CVSS 3.1MEDIUM 5.4 Network No auth User interaction EPSS 0.00507 Published 2021-11-01 Fixed in 1.5.4 CWE-352