Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

4 records

Vendor: Wptaskforce Clear all filters
TI-2022-01317 CVE-2022-1436 · GHSA-5c5x-7wp7-xwgj

WPCargo Track & Trace < 6.9.5 - Reflected Cross Site Scripting

Priority LOW 29

The WPCargo Track & Trace WordPress plugin before 6.9.5 does not sanitise and escape the wpcargo_tracking_number parameter before outputting it back in the page, which could allow attackers to perform reflected Cross-Sit…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.008 Published 2022-05-16 Fixed in 6.9.5 CWE-79
TI-2022-01316 CVE-2022-1435 · GHSA-qgc3-prf8-cxjv

WPCargo Track & Trace < 6.9.5 - Admin+ Stored Cross Site Scripting

Priority LOW 23

The WPCargo Track & Trace WordPress plugin before 6.9.5 does not sanitize and escapes some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltere…

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00598 Published 2022-05-16 Fixed in 6.9.5 CWE-79
TI-2021-07281 CVE-2021-25003 · GHSA-8pgh-m49h-qpxh

WPCargo < 6.9.0 - Unauthenticated RCE

Priority HIGH 75

The WPCargo Track & Trace WordPress plugin before 6.9.0 contains a file which could allow unauthenticated attackers to write a PHP file anywhere on the web server, leading to RCE

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.56148 Published 2022-03-14 Fixed in 6.9.0 CWE-94