Vulnerabilities

TI-2022-00802 CVE-2022-0898 · GHSA-mhjw-crgh-9xcw

IgniteUp <= 3.4.1 - Admin+ Stored Cross-Site Scripting

LOW 25

The IgniteUp WordPress plugin through 3.4.1 does not sanitise and escape some fields when high privilege users don't have the unfiltered_html capability, which could lead to Stored Cross-Site Scripting issues

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00604 Published 2022-05-09 No fix listed CWE-79

TI-2019-12854 CVE-2019-17237 · GHSA-cw7f-www7-p5mv

includes/class-coming-soon-creator.php in the igniteup plugin through 3.4 for WordPress allows CSRF.

LOW 39

includes/class-coming-soon-creator.php in the igniteup plugin through 3.4 for WordPress allows CSRF.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.0074 Published 2019-11-12 No fix listed CWE-352

TI-2019-12853 CVE-2019-17236 · GHSA-49xc-p424-wpxw

includes/class-coming-soon-creator.php in the igniteup plugin through 3.4 for WordPress is vulnerable to stored XSS.

LOW 29

includes/class-coming-soon-creator.php in the igniteup plugin through 3.4 for WordPress is vulnerable to stored XSS.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00966 Published 2019-11-12 No fix listed CWE-79

TI-2019-12852 CVE-2019-17235 · GHSA-6fx2-vvrr-56gc

includes/class-coming-soon-creator.php in the igniteup plugin through 3.4 for WordPress allows information disclosure.

LOW 27

includes/class-coming-soon-creator.php in the igniteup plugin through 3.4 for WordPress allows information disclosure.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.01397 Published 2019-11-12 No fix listed CWE-306

TI-2019-12851 CVE-2019-17234 · GHSA-6362-7f57-p796

includes/class-coming-soon-creator.php in the igniteup plugin through 3.4 for WordPress…

LOW 39

includes/class-coming-soon-creator.php in the igniteup plugin through 3.4 for WordPress allows unauthenticated arbitrary file deletion.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.03248 Published 2019-11-12 No fix listed CWE-306

Vulnerabilities

Filters

IgniteUp <= 3.4.1 - Admin+ Stored Cross-Site Scripting

includes/class-coming-soon-creator.php in the igniteup plugin through 3.4 for WordPress allows CSRF.

includes/class-coming-soon-creator.php in the igniteup plugin through 3.4 for WordPress is vulnerable to stored XSS.

includes/class-coming-soon-creator.php in the igniteup plugin through 3.4 for WordPress allows information disclosure.

includes/class-coming-soon-creator.php in the igniteup plugin through 3.4 for WordPress…