Vulnerabilities

TI-2023-04665 CVE-2023-5070 · GHSA-g8cv-hhj5-2rjx

Social Media Share Buttons & Social Sharing Icons <= 2.8.5 - Information Exposure

LOW 32

The Social Media Share Buttons & Social Sharing Icons plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 2.8.5 via the sfsi_save_export function.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01465 Published 2023-10-20 No fix listed CWE-200

TI-2023-05157 CVE-2023-5602 · GHSA-qpg6-4w2g-v5f5

Social Media Share Buttons & Social Sharing Icons <= 2.8.5 - Cross-Site Request Forgery

LOW 38

The Social Media Share Buttons & Social Sharing Icons plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.8.5.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00269 Published 2023-10-20 No fix listed CWE-352

TI-2023-21847 CVE-2023-41238 · GHSA-4rmq-g99g-cqv6

WordPress Social Media & Share Icons Plugin <= 2.8.3 is vulnerable to Cross Site Scripting (XSS)

LOW 31

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in UltimatelySocial Social Media Share Buttons & Social Sharing Icons plugin <= 2.8.3 versions.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00411 Published 2023-09-27 No fix listed CWE-79

TI-2023-00909 CVE-2023-0958 · GHSA-hpq9-m2jp-4fgr

Inisev Plugins (Various Versions) - Missing Authorization on handle_installation function

LOW 30

Several plugins for WordPress by Inisev are vulnerable to unauthorized installation of plugins due to a missing capability check on the handle_installation function that is called via the inisev_installation AJAX aciton…

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00691 Published 2023-07-28 No fix listed CWE-862

TI-2023-03692 CVE-2023-3977 · GHSA-6jhg-gg85-9xxf

Inisev Plugins (Various Versions) - Cross-Site Request Forgery on handle_installation function

LOW 21

Several plugins for WordPress by Inisev are vulnerable to Cross-Site Request Forgery to unauthorized installation of plugins due to a missing nonce check on the handle_installation function that is called via the inisev_…

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00611 Published 2023-07-28 No fix listed CWE-352

TI-2023-01104 CVE-2023-1166 · GHSA-chj2-8247-g69q

USM Premium < 16.3 - Admin+ Stored XSS

MEDIUM 55

The USM-Premium WordPress plugin before 16.3 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered…

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00477 Published 2023-06-27 Fixed in 16.3