Vulnerabilities

TI-2023-12184 CVE-2023-27452 · GHSA-pf84-fx8r-4c89

WordPress Button Generator – easily Button Builder Plugin <= 2.3.3 is vulnerable to Cross Site Scripting (XSS)

LOW 27

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Wow-Company Button Generator – easily Button Builder plugin <= 2.3.3 versions.

CVSS 3.1MEDIUM 5.9 Network High privileges User interaction EPSS 0.00369 Published 2023-06-22 No fix listed CWE-79

TI-2022-11918 CVE-2022-29448 · GHSA-pq6j-c37f-96x2

WordPress Herd Effects plugin <= 5.2 - Local File Inclusion (LFI) vulnerability

LOW 34

Authenticated (admin or higher user role) Local File Inclusion (LFI) vulnerability in Wow-Company's Herd Effects plugin <= 5.2 at WordPress.

CVSS 3.1MEDIUM 6.8 Network High privileges User interaction EPSS 0.01027 Published 2022-05-20 No fix listed CWE-706

TI-2022-11915 CVE-2022-29445 · GHSA-7jq5-gwqv-xc5f

WordPress Popup Box plugin <= 2.1.2 - Authenticated Local File Inclusion (LFI) vulnerability

LOW 36

Authenticated (administrator or higher role) Local File Inclusion (LFI) vulnerability in Wow-Company's Popup Box plugin <= 2.1.2 at WordPress.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.0105 Published 2022-05-18 No fix listed CWE-706

TI-2022-00242 CVE-2022-0313 · GHSA-rp6m-v76g-9wr4

Float Menu < 4.3.1 - Arbitrary Menu Deletion via CSRF

LOW 20

The Float menu WordPress plugin before 4.3.1 does not have CSRF check in place when deleting menu, which could allow attackers to make a logged in admin delete them via a CSRF attack

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00471 Published 2022-02-21 Fixed in 4.3.1 CWE-352

TI-2021-06864 CVE-2021-24580 · GHSA-2mxj-pg8q-6c2c

Side Menu Lite < 2.2.6 - Authenticated SQL Injection

MEDIUM 41

The Side Menu Lite WordPress plugin before 2.2.6 does not sanitise user input from the List page in the admin dashboard before using it in SQL statement, leading to a SQL Injection issue

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01362 Published 2021-08-30 Fixed in 2.2.6 CWE-89

TI-2021-06808 CVE-2021-24521 · GHSA-39jf-84mp-m232

Side Menu Lite < 2.2.1 - Authenticated SQL Injection

LOW 35

The Side Menu Lite – add sticky fixed buttons WordPress plugin before 2.2.1 does not properly sanitize input values from the browser when building an SQL statement.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.01587 Published 2021-08-09 Fixed in 2.2.1 CWE-89

TI-2021-06640 CVE-2021-24348 · GHSA-3545-vxgq-p67f

Side Menu < 3.1.5 - Authenticated (admin+) SQL Injection