CVSS: 4.4EPSS: 0%CPEs: 1EXPL: 0CVE-2024-7618 – Community by PeepSo – Social Network, Membership, Registration, User Profiles <= 6.4.5.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via content Parameter
https://notcve.org/view.php?id=CVE-2024-7618
The Community by PeepSo – Social Network, Membership, Registration, User Profiles plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘content’ parameter in all versions up to, and including, 6.4.5.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. • https://plugins.trac.wordpress.org/browser/peepso-core/tags/6.4.4.0/templates/reactions/admin_reaction.php#L112 https://plugins.trac.wordpress.org/browser/peepso-core/tags/6.4.6.0/classes/adminconfigreactions.php?rev=3147528#L88 https://plugins.trac.wordpress.org/changeset/3147528 https://wordpress.org/plugins/peepso-core/#developers https://www.peepso.com/changelog https://www.wordfence.com/threat-intel/vulnerabilities/id/edf2e060-5ae4-4b46-bc68-22ae5f516fe8?source=cve • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.4EPSS: 0%CPEs: 1EXPL: 0CVE-2024-7655 – Community by PeepSo – Social Network, Membership, Registration, User Profiles <= 6.4.5.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2024-7655
The Community by PeepSo – Social Network, Membership, Registration, User Profiles plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 6.4.5.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. • https://plugins.trac.wordpress.org/browser/peepso-core/tags/6.4.6.0/classes/adminconfigfields.php?rev=3147528#L17 https://plugins.trac.wordpress.org/changeset/3147528 https://wordpress.org/plugins/peepso-core/#developers https://www.peepso.com/6-4-6-0 https://www.peepso.com/changelog https://www.wordfence.com/threat-intel/vulnerabilities/id/e85ee611-ae81-4736-b4f0-b9d06714da18?source=cve • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2024-25923 – WordPress Community by PeepSo plugin <= 6.2.7.0 - Sensitive Data Exposure via Log File vulnerability
https://notcve.org/view.php?id=CVE-2024-25923
Insertion of Sensitive Information into Log File vulnerability in PeepSo Community by PeepSo.This issue affects Community by PeepSo: from n/a through 6.2.7.0. Inserción de información confidencial en la vulnerabilidad del archivo de registro en PeepSo Community by PeepSo. Este problema afecta a Community by PeepSo: desde n/a hasta 6.2.7.0. The Community by PeepSo – Social Network, Membership, Registration, User Profiles plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 6.2.7.0. This makes it possible for unauthenticated attackers to extract sensitive data from log files. • https://patchstack.com/database/vulnerability/peepso-core/wordpress-community-by-peepso-plugin-6-2-7-0-sensitive-data-exposure-via-log-file-vulnerability?_s_id=cve • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-532: Insertion of Sensitive Information into Log File •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2024-22158 – WordPress PeepSo Core: Photos Plugin < 6.3.1.0 is vulnerable to Cross Site Scripting (XSS)
https://notcve.org/view.php?id=CVE-2024-22158
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PeepSo Community by PeepSo – Social Network, Membership, Registration, User Profiles allows Stored XSS.This issue affects Community by PeepSo – Social Network, Membership, Registration, User Profiles: from n/a before 6.3.1.0. La vulnerabilidad de neutralización incorrecta de la entrada durante de generación de páginas web ('Cross-site Scripting') en PeepSo Community by PeepSo – Social Network, Membership, Registration, User Profiles permite XSS almacenado. Este problema afecta a Community by PeepSo – Social Network, Membership, Registration, User Profiles: desde n/a antes de 6.3.1.0. The PeepSo Core: Photos plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an unknown parameter in versions up to 6.3.1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. • https://patchstack.com/database/vulnerability/peepso-photos/wordpress-peepso-photos-add-on-plugin-6-3-1-0-cross-site-scripting-xss-vulnerability?_s_id=cve • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 1CVE-2023-7125 – Community by PeepSo < 6.3.1.2 - User Post Creation via CSRF
https://notcve.org/view.php?id=CVE-2023-7125
The Community by PeepSo WordPress plugin before 6.3.1.2 does not have CSRF check when creating a user post (visible on their wall in their profile page), which could allow attackers to make logged in users perform such action via a CSRF attack El complemento de WordPress Community by PeepSo anterior a 6.3.1.2 no tiene verificación CSRF al crear una publicación de usuario (visible en su muro en su página de perfil), lo que podría permitir a los atacantes hacer que los usuarios que han iniciado sesión realicen dicha acción a través de un ataque CSRF. The Community by PeepSo – Social Network, Membership, Registration, User Profiles plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.3.1.1. This is due to missing or incorrect nonce validation. This makes it possible for unauthenticated attackers to create user posts on other members walls via a forged request granted they can trick a sites' user into performing an action such as clicking on a link. CVE-2024-31251 appears to be a potential duplicate of this issue. • https://wpscan.com/vulnerability/cac12b64-ed25-4ee2-933f-8ff722605271 • CWE-352: Cross-Site Request Forgery (CSRF) •