Vulnerabilities

TI-2022-03884 CVE-2022-4243 · GHSA-6f2v-4hjj-j2px

ImageInject <= 1.17 - Admin+ Stored XSS

MEDIUM 55

The ImageInject WordPress plugin through 1.17 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltere…

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00559 Published 2022-12-26 No fix listed

TI-2018-03838 CVE-2018-5285 · GHSA-8mfg-87wm-gxff

The ImageInject plugin 1.15 for WordPress has CSRF via wp-admin/options-general.php.

LOW 39

The ImageInject plugin 1.15 for WordPress has CSRF via wp-admin/options-general.php.

CVSS 3.0HIGH 8.8 Network No auth User interaction EPSS 0.00726 Published 2018-01-08 No fix listed CWE-352

TI-2018-03837 CVE-2018-5284 · GHSA-947j-c9q4-rh85

The ImageInject plugin 1.15 for WordPress has XSS via the flickr_appid parameter to wp-admin/options-general.php.

LOW 23

The ImageInject plugin 1.15 for WordPress has XSS via the flickr_appid parameter to wp-admin/options-general.php.

CVSS 3.0MEDIUM 4.8 Network High privileges User interaction EPSS 0.00799 Published 2018-01-08 No fix listed CWE-79

Vulnerabilities

Filters

ImageInject <= 1.17 - Admin+ Stored XSS

The ImageInject plugin 1.15 for WordPress has CSRF via wp-admin/options-general.php.

The ImageInject plugin 1.15 for WordPress has XSS via the flickr_appid parameter to wp-admin/options-general.php.