Vulnerabilities

TI-2023-12734 CVE-2023-28165 · GHSA-mw9g-9rrr-6ph5

WordPress Backup Bank: WordPress Backup Plugin plugin <= 4.0.28 - Broken Access Control vulnerability

LOW 20

Missing Authorization vulnerability in Tech Banker Backup Bank: WordPress Backup Plugin allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Backup Bank: WordPress Backup Plugin: fro…

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00382 Published 2024-12-09 No fix listed CWE-862

TI-2024-08698 CVE-2024-9375 · GHSA-gg28-j4wr-8f8f

WordPress Captcha Plugin by Captcha Bank <= 4.0.36 - Reflected Cross-Site Scripting

LOW 27

The WordPress Captcha Plugin by Captcha Bank plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and includi…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00317 Published 2024-10-04 No fix listed CWE-79

TI-2022-03096 CVE-2022-3350 · GHSA-3vx5-mrc3-jc23

Contact Bank <= 3.0.30 - Admin+ Stored Cross-Site Scripting

MEDIUM 55

The Contact Bank WordPress plugin through 3.0.30 does not sanitise and escape some of its Form settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the u…

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00676 Published 2022-10-25 No fix listed CWE-79

TI-2014-07187 CVE-2014-8758 · GHSA-2c42-f2qj-vh3h

Cross-site scripting (XSS) vulnerability in Best Gallery Albums Plugin before 3.0.70for…

LOW 30

Cross-site scripting (XSS) vulnerability in Best Gallery Albums Plugin before 3.0.70for WordPress allows remote attackers to inject arbitrary web script or HTML via the order_id parameter in the gallery_album_sorting pag…

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.0118 Published 2017-10-06 No fix listed CWE-79

TI-2014-03119 CVE-2014-3841 · GHSA-5fm4-2ggp-45cj

Cross-site scripting (XSS) vulnerability in the Contact Bank plugin before 2.0.20 for…

LOW 24

Cross-site scripting (XSS) vulnerability in the Contact Bank plugin before 2.0.20 for WordPress allows remote attackers to inject arbitrary web script or HTML via the Label field, related to form layout configuration.

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.01948 Published 2014-05-22 No fix listed CWE-79