Vulnerabilities

TI-2024-31666 CVE-2024-47348 · GHSA-6h8v-9rcv-rf6g

WordPress Visual CSS Style Editor plugin <= 7.6.4 - Reflected Cross Site Scripting (XSS) vulnerability

LOW 31

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in YellowPencil YellowPencil Visual CSS Style Editor yellow-pencil-visual-theme-customizer allows Reflected XSS.This issu…

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.0032 Published 2024-10-06 No fix listed CWE-79

TI-2021-07213 CVE-2021-24934 · GHSA-7579-2v4g-9grv

Visual CSS Style Editor < 7.5.4 - Reflected Cross-Site Scripting

LOW 30

The Visual CSS Style Editor WordPress plugin before 7.5.4 does not sanitise and escape the wyp_page_type parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting issue

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01397 Published 2022-02-01 Fixed in 7.5.4 CWE-79

TI-2019-08912 CVE-2019-11886 · GHSA-hrmr-jgrx-82h5

The WaspThemes Visual CSS Style Editor (aka yellow-pencil-visual-theme-customizer) plugin…

MEDIUM 42

The WaspThemes Visual CSS Style Editor (aka yellow-pencil-visual-theme-customizer) plugin before 7.2.1 for WordPress allows yp_option_update CSRF, as demonstrated by use of yp_remote_get to obtain admin access.

CVSS 3.0HIGH 8.8 Network No auth User interaction EPSS 0.02281 Published 2019-05-13 No fix listed CWE-352

Vulnerabilities

Filters

WordPress Visual CSS Style Editor plugin <= 7.6.4 - Reflected Cross Site Scripting (XSS) vulnerability

Visual CSS Style Editor < 7.5.4 - Reflected Cross-Site Scripting

The WaspThemes Visual CSS Style Editor (aka yellow-pencil-visual-theme-customizer) plugin…