CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2024-12417 – Simple Link Directory <= 8.4.0 - Unauthenticated Arbitrary Shortcode Execution
https://notcve.org/view.php?id=CVE-2024-12417
The The Simple Link Directory plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 8.4.0. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. • https://plugins.trac.wordpress.org/browser/simple-link-directory/trunk/embed/qcopd-embed-link.php#L17 https://plugins.trac.wordpress.org/changeset/3206971/simple-link-directory/trunk/embed/qcopd-embed-link.php https://www.wordfence.com/threat-intel/vulnerabilities/id/b7112840-f190-4867-9408-c96408f28b7a?source=cve • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 9.8EPSS: 7%CPEs: 1EXPL: 1CVE-2022-0760 – Simple Link Directory < 7.7.2 - Unauthenticated SQL injection
https://notcve.org/view.php?id=CVE-2022-0760
The Simple Link Directory WordPress plugin before 7.7.2 does not validate and escape the post_id parameter before using it in a SQL statement via the qcopd_upvote_action AJAX action (available to unauthenticated and authenticated users), leading to an unauthenticated SQL Injection El plugin Simple Link Directory de WordPress versiones anteriores a 7.7.2 no comprueba ni escapa el parámetro post_id antes de usarlo en una sentencia SQL por medio de la acción AJAX qcopd_upvote_action (disponible para usuarios autenticados y no autenticados), conllevando a una inyección SQL no autenticada The Simple Link Directory WordPress plugin before 7.7.2 does not validate and escape the post_id parameter before using it in a SQL statement via the qcopd_upvote_action AJAX action (available to unauthenticated and authenticated users), leading to an unauthenticated SQL Injection. • https://plugins.trac.wordpress.org/changeset/2684915 https://wpscan.com/vulnerability/1c83ed73-ef02-45c0-a9ab-68a3468d2210 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2019-13463 – Simple Link Directory < 7.3.5 - Reflected Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2019-13463
An XSS vulnerability in qcopd-shortcode-generator.php in the Simple Link Directory plugin before 7.3.5 for WordPress allows remote attackers to inject arbitrary web script or HTML, because esc_html is not called for the "echo get_the_title()" or "echo $term->name" statement. Una vulnerabilidad de tipo XSS en el archivo qcopd-shortcode-generator.php en el plugin Simple Link Directory versiones anteriores a 7.3.5 para WordPress, permite a atacantes remotos inyectar un script web o HTML arbitrario, porque esc_html no es llamado para la sentencia de "echo get_the_title()" o "echo $term->name". • https://plugins.trac.wordpress.org/changeset?old_path=%2Fsimple-link-directory&old=2111131&new_path=%2Fsimple-link-directory&new=2111132&sfp_email=&sfph_mail= https://wordpress.org/plugins/simple-link-directory/#developers • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •