Vulnerabilities

TI-2022-19674 CVE-2022-41155 · GHSA-89h5-3m3x-c8hj

WordPress iQ Block Country plugin <= 1.2.18 - Block BYPASS vulnerability

MEDIUM 49

Block BYPASS vulnerability in iQ Block Country plugin <= 1.2.18 on WordPress.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00751 Published 2022-11-18 No fix listed CWE-284

TI-2022-01628 CVE-2022-1762 · GHSA-78xv-3xpm-3hcq

iQ Block Country < 1.2.20 - Protection Bypass due to IP Spoofing

LOW 35

The iQ Block Country WordPress plugin before 1.2.20 does not properly checks HTTP headers in order to validate the origin IP address, allowing threat actors to bypass it's block feature by spoofing the headers.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0126 Published 2022-06-13 Fixed in 1.2.20

TI-2022-00181 CVE-2022-0246 · GHSA-cxp6-jhjh-h4hg

iQ Block Country < 1.2.13 - Admin+ Arbitrary File Deletion via Zip Slip

LOW 28

The settings of the iQ Block Country WordPress plugin before 1.2.13 can be exported or imported using its backup functionality.

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.03367 Published 2022-04-11 Fixed in 1.2.13 CWE-73

TI-2021-14965 CVE-2021-36873 · GHSA-5mcg-fw36-rwf2

WordPress iQ Block Country plugin <= 1.2.11 - Authenticated Persistent Cross-Site Scripting (XSS) vulnerability

LOW 27

Authenticated Persistent Cross-Site Scripting (XSS) vulnerability in WordPress iQ Block Country plugin (versions <= 1.2.11).

CVSS 3.1MEDIUM 5.5 Network High privileges No interaction EPSS 0.01215 Published 2021-09-23 No fix listed CWE-79

Vulnerabilities

Filters

WordPress iQ Block Country plugin <= 1.2.18 - Block BYPASS vulnerability

iQ Block Country < 1.2.20 - Protection Bypass due to IP Spoofing

iQ Block Country < 1.2.13 - Admin+ Arbitrary File Deletion via Zip Slip

WordPress iQ Block Country plugin <= 1.2.11 - Authenticated Persistent Cross-Site Scripting (XSS) vulnerability