Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

10 records

Vendor: AAM Clear all filters
TI-2019-15267 CVE-2019-25213 · GHSA-wx98-rpcr-jrwv

Advanced Access Manager <= 5.9.8.1 - Unauthenticated Arbitrary File Read

Priority MEDIUM 54

The Advanced Access Manager plugin for WordPress is vulnerable to Unauthenticated Arbitrary File Read in versions up to, and including, 5.9.8.1 due to insufficient validation on the aam-media parameter.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02772 Published 2024-10-16 Fixed in 5.9.9 CWE-22
TI-2024-19298 CVE-2024-29124 · GHSA-g53m-685r-w68h

WordPress Advanced Access Manager plugin <= 6.9.20 - Cross Site Scripting (XSS) vulnerability

Priority LOW 27

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AAM Advanced Access Manager allows Stored XSS.This issue affects Advanced Access Manager: from n/a through 6.9.20.

CVSS 3.1MEDIUM 5.9 Network High privileges User interaction EPSS 0.00375 Published 2024-03-19 No fix listed CWE-79
TI-2024-19301 CVE-2024-29127 · GHSA-f445-jjfc-wcm9

WordPress Advanced Access Manager plugin <= 6.9.20 - Reflected Cross Site Scripting (XSS) vulnerability

Priority LOW 32

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AAM Advanced Access Manager allows Reflected XSS.This issue affects Advanced Access Manager: from n/a through 6.9.20.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00438 Published 2024-03-19 No fix listed CWE-79
TI-2023-28321 CVE-2023-51674 · GHSA-85pp-8vhv-c78m

WordPress Advanced Access Manager Plugin <= 6.9.18 is vulnerable to Cross Site Scripting (XSS)

Priority LOW 29

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AAM Advanced Access Manager – Restricted Content, Users & Roles, Enhanced Security and More allows Stored XSS.This iss…

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00328 Published 2024-02-01 No fix listed CWE-79
TI-2023-28322 CVE-2023-51675 · GHSA-x776-gq32-gc5c

WordPress Advanced Access Manager Plugin <= 6.9.18 is vulnerable to Open Redirection

Priority LOW 24

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in AAM Advanced Access Manager – Restricted Content, Users & Roles, Enhanced Security and More.This issue affects Advanced Access Manager – Restricted Con…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00297 Published 2023-12-29 No fix listed CWE-601
TI-2023-27785 CVE-2023-50881 · GHSA-2cfj-r94q-xgfj

WordPress Advanced Access Manager Plugin <= 6.9.15 is vulnerable to Cross Site Scripting (XSS)

Priority LOW 29

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AAM Advanced Access Manager – Restricted Content, Users & Roles, Enhanced Security and More allows Stored XSS.This iss…

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00309 Published 2023-12-29 No fix listed CWE-79
TI-2021-07112 CVE-2021-24830 · GHSA-h54q-fpvg-vhq5

Advanced Access Manager < 6.8.0 - Admin+ Stored Cross-Site Scripting

Priority LOW 23

The Advanced Access Manager WordPress plugin before 6.8.0 does not escape some of its settings when outputting them, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html cap…

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00676 Published 2021-11-23 Fixed in 6.8.0 CWE-79