CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 1CVE-2022-2114 – Data Tables Generator by Supsystic < 1.10.20 - Admin+ Stored Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2022-2114
The Data Tables Generator by Supsystic WordPress plugin before 1.10.20 does not sanitise and escape some of its Table settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed (for example in multisite setup) El plugin Data Tables Generator by Supsystic de WordPress versiones anteriores a 1.10.20, no sanea ni escapa de algunos de sus ajustes de tabla, lo que podría permitir a usuarios con altos privilegios, como el administrador, llevar a cabo ataques de tipo Cross-Site Scripting cuando la capacidad unfiltered_html no está permitida (por ejemplo, en una configuración multisitio) • https://wpscan.com/vulnerability/59911ba4-fa06-498a-9e7c-0c337cce691c • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.6EPSS: 0%CPEs: 1EXPL: 0CVE-2020-12076 – Data Tables Generator by Supsystic <= 1.9.91 - Cross-Site Request Forgery
https://notcve.org/view.php?id=CVE-2020-12076
The data-tables-generator-by-supsystic plugin before 1.9.92 for WordPress lacks CSRF nonce checks for AJAX actions. One consequence of this is stored XSS. El plugin data-tables-generator-by-supsystic en versiones anteriores a la para WordPress carece de comprobaciones CSRF nonce para acciones AJAX. Una consecuencia de esto es XSS almacenado. The Data Tables Generator by Supsystic plugin before 1.9.92 for WordPress lacks CSRF nonce checks for AJAX actions. • https://www.wordfence.com/blog/2020/03/vulnerabilities-patched-in-the-data-tables-generator-by-supsystic-plugin • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 1CVE-2020-12075 – Data Tables Generator by Supsystic <= 1.9.91 - Missing Authorization on AJAX Actions
https://notcve.org/view.php?id=CVE-2020-12075
The data-tables-generator-by-supsystic plugin before 1.9.92 for WordPress lacks capability checks for AJAX actions. El plugin data-tables-generator-by-supsystic en versiones anteriores a la 1.9.92 para WordPress carece de comprobaciones de capacidad para acciones AJAX. • https://www.wordfence.com/blog/2020/03/vulnerabilities-patched-in-the-data-tables-generator-by-supsystic-plugin • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CWE-276: Incorrect Default Permissions •