Vulnerabilities

TI-2024-11683 CVE-2024-12591 · GHSA-x9rh-cvcx-crcc

MagicPost <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via wb_share_social Shortcode

LOW 28

The MagicPost plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wb_share_social shortcode in all versions up to, and including, 1.2.1 due to insufficient input sanitization and output esc…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00346 Published 2024-12-21 No fix listed CWE-79

TI-2024-05863 CVE-2024-6319 · GHSA-fmjc-52jw-jgcm

IMGspider <= 2.3.10 - Authenticated (Contributor+) Arbitrary File Upload via 'upload'

MEDIUM 42

The IMGspider plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'upload' function in all versions up to, and including, 2.3.10.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00939 Published 2024-07-04 No fix listed CWE-434

TI-2024-05862 CVE-2024-6318 · GHSA-w388-4xq6-fqmw

IMGspider <= 2.3.10 - Authenticated (Contributor+) Arbitrary File Upload via 'upload_img_file'

MEDIUM 42

The IMGspider plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'upload_img_file' function in all versions up to, and including, 2.3.10.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00939 Published 2024-07-04 No fix listed CWE-434

TI-2023-11668 CVE-2023-26531 · GHSA-j2vp-ggq4-7c56

Cross-site request forgery in 闪电博多合一搜索自动推送管理插件-支持Baidu/Google/Bing/IndexNow/Yandex/头条

LOW 38

Cross-Site Request Forgery (CSRF) vulnerability in 闪电博多合一搜索自动推送管理插件-支持Baidu/Google/Bing/IndexNow/Yandex/头条 allows Cross Site Request Forgery.This issue affects 多合一搜索自动推送管理插件-支持Baidu/Google/Bing/IndexNow/Yandex/头条: from…

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00301 Published 2023-11-12 No fix listed CWE-352

TI-2021-07255 CVE-2021-24976 · GHSA-555p-jhmj-xhrc

Smart SEO Tool < 3.0.6 - Reflected Cross-Site Scripting

LOW 29

The Smart SEO Tool WordPress plugin before 3.0.6 does not sanitise and escape the search parameter before outputting it back in an attribute when the TDK optimisation setting is enabled, leading to a Reflected Cross-Site…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00917 Published 2022-01-24 Fixed in 3.0.6 CWE-79

TI-2021-06901 CVE-2021-24618 · GHSA-3g5v-m9jm-mw8w

Donate With QRCode < 1.4.5 - Stored Cross-Site Scripting

LOW 25

The Donate With QRCode WordPress plugin before 1.4.5 does not sanitise or escape its QRCode Image setting, which result into a Stored Cross-Site Scripting (XSS).

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00386 Published 2021-09-20 Fixed in 1.4.5 CWE-352