Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

5 records

Vendor: gandhihitesh9 Clear all filters
TI-2024-05811 CVE-2024-6264 · GHSA-9p35-w9w3-v722

Post Meta Data Manager <= 1.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting

Priority LOW 28

The Post Meta Data Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘$meta_key’ parameter in all versions up to, and including, 1.2.3 due to insufficient input sanitization and output esc…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00341 Published 2024-07-02 No fix listed CWE-79
TI-2023-04994 CVE-2023-5425 · GHSA-7vmh-92c8-vp9r

Post Meta Data Manager <=1.2.0 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation

Priority MEDIUM 41

The Post Meta Data Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the pmdm_wp_change_user_meta and pmdm_wp_change_post_meta functions in versions up t…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00669 Published 2023-10-28 No fix listed CWE-862
TI-2023-04995 CVE-2023-5426 · GHSA-v2p6-vvrh-9hw7

Post Meta Data Manager <=1.2.0 - Missing Authorization to User, Term, and Post Meta Deletion

Priority MEDIUM 40

The Post Meta Data Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the pmdm_wp_delete_user_meta, pmdm_wp_delete_term_meta, and pmdm_wp_ajax_delete_meta…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0056 Published 2023-10-28 No fix listed CWE-862