Vulnerabilities

TI-2024-07923 CVE-2024-8547 · GHSA-rg9r-48rh-6w56

Simple Popup Plugin <= 4.5 - Authenticated (Contributor+) Stored Cross-Site Scripting

LOW 29

The Simple Popup Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's [popup] shortcode in all versions up to, and including, 4.5 due to insufficient input sanitization and output esc…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00383 Published 2024-09-28 No fix listed CWE-79

TI-2023-10038 CVE-2023-24416 · GHSA-hfqr-7mcf-f22q

WordPress All In One Favicon Plugin <= 4.7 is vulnerable to Arbitrary File Deletion

LOW 31

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Arne Franken All In One Favicon.This issue affects All In One Favicon: from n/a through 4.7.

CVSS 3.1MEDIUM 6.8 Network High privileges No interaction EPSS 0.00777 Published 2024-02-23 No fix listed CWE-22

Vulnerabilities

Filters

Simple Popup Plugin <= 4.5 - Authenticated (Contributor+) Stored Cross-Site Scripting

WordPress All In One Favicon Plugin <= 4.7 is vulnerable to Arbitrary File Deletion