CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2023-28493 – WordPress Newsmag Theme <= 2.4.4 is vulnerable to Cross Site Scripting (XSS)
https://notcve.org/view.php?id=CVE-2023-28493
16 Mar 2023 — Auth (subscriber+) Reflected Cross-Site Scripting (XSS) vulnerability in Macho Themes NewsMag theme <= 2.4.4 versions. The Newsmag theme for WordPress is vulnerable to Stored Cross-Site Scripting via an unknown parameter in versions up to, and including, 2.4.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Auth (subscriber+) Reflected Cross-S... • https://patchstack.com/database/vulnerability/newsmag/wordpress-newsmag-theme-2-4-4-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 10.0EPSS: 0%CPEs: 3EXPL: 1CVE-2022-3477 – tagDiv Composer < 3.5 - Unauthenticated Account Takeover
https://notcve.org/view.php?id=CVE-2022-3477
24 Oct 2022 — The tagDiv Composer WordPress plugin before 3.5, required by the Newspaper WordPress theme before 12.1 and Newsmag WordPress theme before 5.2.2, does not properly implement the Facebook login feature, allowing unauthenticated attackers to login as any user by just knowing their email address El complemento de WordPress tagDiv Composer anterior a 3.5, requerido por el tema Newspaper WordPress anterior a 12.1 y el tema Newsmag de WordPress anterior a 5.2.2, no implementa correctamente la función de inicio de ... • https://wpscan.com/vulnerability/993a95d2-6fce-48de-ae17-06ce2db829ef • CWE-287: Improper Authentication CWE-288: Authentication Bypass Using an Alternate Path or Channel •
CVSS: 6.1EPSS: 1%CPEs: 1EXPL: 1CVE-2021-24304 – Newsmag < 5.0 - Unauthenticated Reflected Cross-site Scripting (XSS)
https://notcve.org/view.php?id=CVE-2021-24304
12 Jul 2021 — The Newsmag WordPress theme before 5.0 does not sanitise the td_block_id parameter in its td_ajax_block AJAX action, leading to an unauthenticated Reflected Cross-site Scripting (XSS) vulnerability. El tema de Newsmag WordPress versiones anteriores a 5.0, no sanea el parámetro td_block_id en su acción AJAX td_ajax_block, conllevando a una vulnerabilidad de tipo Cross-Site Scripting (XSS) Reflejado no autenticado • https://wpscan.com/vulnerability/bb71f2f9-76bd-43f4-a8c9-35771dd28dff • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.5EPSS: 0%CPEs: 15EXPL: 1CVE-2020-36721 – Epsilon Framework Themes (Various Versions) - Unauthenticated Plugin Activation/Deactivation
https://notcve.org/view.php?id=CVE-2020-36721
01 Oct 2020 — The Brilliance <= 1.2.7, Activello <= 1.4.0, and Newspaper X <= 1.3.1 themes for WordPress are vulnerable to Plugin Activation/Deactivation. This is due to the 'activello_activate_plugin' and 'activello_deactivate_plugin' functions in the 'inc/welcome-screen/class-activello-welcome.php' file missing capability and security checks/nonces. This makes it possible for unauthenticated attackers to activate and deactivate arbitrary plugins installed on a vulnerable site. • https://blog.nintechnet.com/unauthenticated-function-injection-vulnerability-fixed-in-15-wordpress-themes • CWE-284: Improper Access Control CWE-862: Missing Authorization •
CVSS: 10.0EPSS: 76%CPEs: 16EXPL: 2CVE-2020-36708 – Epsilon Framework Themes (Various Versions) - Function Injection
https://notcve.org/view.php?id=CVE-2020-36708
01 Oct 2020 — The following themes for WordPress are vulnerable to Function Injections in versions up to and including Shapely <= 1.2.7, NewsMag <= 2.4.1, Activello <= 1.4.0, Illdy <= 2.1.4, Allegiant <= 1.2.2, Newspaper X <= 1.3.1, Pixova Lite <= 2.0.5, Brilliance <= 1.2.7, MedZone Lite <= 1.2.4, Regina Lite <= 2.0.4, Transcend <= 1.1.8, Affluent <= 1.1.0, Bonkers <= 1.0.4, Antreas <= 1.0.2, Sparkling <= 2.4.8, and NatureMag Lite <= 1.0.4. This is due to epsilon_framework_ajax_action. This makes it possible for unauthen... • https://blog.nintechnet.com/unauthenticated-function-injection-vulnerability-fixed-in-15-wordpress-themes • CWE-94: Improper Control of Generation of Code ('Code Injection') •