CVSS: 8.5EPSS: 0%CPEs: 1EXPL: 0CVE-2024-47304 – WordPress Fluent Support plugin <= 1.8.0 - SQL Injection vulnerability
https://notcve.org/view.php?id=CVE-2024-47304
25 Sep 2024 — Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPManageNinja LLC Fluent Support allows SQL Injection.This issue affects Fluent Support: from n/a through 1.8.0. The Fluent Support plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 1.8.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscri... • https://patchstack.com/database/vulnerability/fluent-support/wordpress-fluent-support-plugin-1-8-0-sql-injection-vulnerability?_s_id=cve • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2024-47302 – WordPress Fluent Support plugin <= 1.8.0 - Broken Access Control on Email Verification vulnerability
https://notcve.org/view.php?id=CVE-2024-47302
25 Sep 2024 — Missing Authorization vulnerability in WPManageNinja LLC Fluent Support allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Fluent Support: from n/a through 1.8.0. The Fluent Support plugin for WordPress is vulnerable to unauthorized email verification due to insufficient validation on the sendSignupEmailVerificationHtml ()function in versions up to, and including, 1.8.0. This makes it possible for unauthenticated attackers to verify emails that do not belong to themse... • https://patchstack.com/database/vulnerability/fluent-support/wordpress-fluent-support-plugin-1-8-0-broken-access-control-on-email-verification-vulnerability?_s_id=cve • CWE-862: Missing Authorization •