Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
1 selected

4 records

Vendor: Riverforest-wp Clear all filters
TI-2023-03731 CVE-2023-4019 · GHSA-jmf8-xh4v-2pr9

Media from FTP < 11.17 - Author+ Arbitrary File Access

Priority HIGH 73

The Media from FTP WordPress plugin before 11.17 does not properly limit who can use the plugin, which may allow users with author+ privileges to move files around, like wp-config.php, which may lead to RCE in some cases…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00823 Published 2023-09-04 Fixed in 11.17
TI-2023-03735 CVE-2023-4023 · GHSA-7rm2-xq32-ww37

All Users Messenger <= 1.24 - Subscriber+ Message Deletion via IDOR

Priority MEDIUM 53

The All Users Messenger WordPress plugin through 1.24 does not prevent non-administrator users from deleting messages from the all-users messenger.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00483 Published 2023-08-30 No fix listed
TI-2023-03744 CVE-2023-4035 · GHSA-8hw5-9v34-vmg4

Simple Blog Card < 1.31 - Contributor+ Stored XSS via Shortcode

Priority MEDIUM 58

The Simple Blog Card WordPress plugin before 1.31 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the co…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00433 Published 2023-08-30 Fixed in 1.31
TI-2023-03745 CVE-2023-4036 · GHSA-j874-rmjf-2w72

Simple Blog Card < 1.32 - Subscriber+ Arbitrary Post Access

Priority MEDIUM 53

The Simple Blog Card WordPress plugin before 1.32 does not ensure that posts to be displayed via a shortcode are public, allowing any authenticated users, such as subscriber, to retrieve arbitrary post title and their co…

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00553 Published 2023-08-30 Fixed in 1.32