Vulnerabilities

TI-2024-11712 CVE-2024-12621 · GHSA-cfrq-gw8f-c8gg

Yumpu E-Paper publishing <= 3.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting

LOW 28

The Yumpu E-Paper publishing plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'YUMPU' shortcode in all versions up to, and including, 3.0.8 due to insufficient input sanitization and out…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00354 Published 2025-01-09 No fix listed CWE-79

TI-2024-03074 CVE-2024-3277

Yumpu ePaper publishing <= 2.0.24 - Missing Authorization to PDF Upload, Publishing, and API Key Modification

LOW 23

The Yumpu ePaper publishing plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajax_handler function in all versions up to, and including, 2.0.24.

CVSS 3.1MEDIUM 5.0 Network Low privileges No interaction EPSS 0.00316 Published 2024-05-30 No fix listed CWE-862

Vulnerabilities

Filters

Yumpu E-Paper publishing <= 3.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting

Yumpu ePaper publishing <= 2.0.24 - Missing Authorization to PDF Upload, Publishing, and API Key Modification