Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Vendor: wpvar Clear all filters
TI-2023-00319 CVE-2023-0335 · GHSA-jhxw-3422-m7cw

WP Shamsi <= 4.3.3 - Subscriber+ Attachment Deletion

Priority MEDIUM 62

The WP Shamsi WordPress plugin through 4.3.3 has CSRF and broken access control vulnerabilities which leads user with role as low as subscriber delete attachment.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01003 Published 2023-03-27 No fix listed CWE-352
TI-2022-04159 CVE-2022-4555 · GHSA-2pq5-28h7-2x78

WP Shamsi <= 4.1.0 - Missing Authorization to Arbitrary Plugin Deactivation

Priority LOW 36

The WP Shamsi plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the deactivate() function hooked via init() in versions up to, and including, 4.1.0.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00716 Published 2022-12-16 No fix listed CWE-862