Vulnerabilities

TI-2024-12436 CVE-2024-13394 · GHSA-r7fh-8xgp-xjw3

ViewMedica 9 <= 1.4.18 - Authenticated (Contributor+) Stored Cross-Site Scripting

LOW 29

The ViewMedica 9 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'viewmedica' shortcode in all versions up to, and including, 1.4.18 due to insufficient input sanitization and output es…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00444 Published 2025-01-15 No fix listed CWE-79

TI-2024-11401 CVE-2024-12291 · GHSA-pgpc-4xx9-5qrm

ViewMedica 9 <= 1.4.17 - Cross-Site Request Forgery to Reflected Cross-Site Scripting

LOW 27

The ViewMedica 9 plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.17.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00197 Published 2025-01-07 No fix listed CWE-352

TI-2024-11285 CVE-2024-12170 · GHSA-hv98-m6w4-qrr6

ViewMedica Embed <= 1.4.15 - Cross-Site Request Forgery to SQL Injection

LOW 24

The ViewMedica 9 plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.15.

CVSS 3.1MEDIUM 5.4 Network No auth User interaction EPSS 0.00194 Published 2025-01-07 No fix listed CWE-352

Vulnerabilities

Filters

ViewMedica 9 <= 1.4.18 - Authenticated (Contributor+) Stored Cross-Site Scripting

ViewMedica 9 <= 1.4.17 - Cross-Site Request Forgery to Reflected Cross-Site Scripting

ViewMedica Embed <= 1.4.15 - Cross-Site Request Forgery to SQL Injection