CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2023-45607 – WordPress WordPress Popular Posts Plugin <= 6.3.2 is vulnerable to Cross Site Scripting (XSS)
https://notcve.org/view.php?id=CVE-2023-45607
Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Hector Cabrera WordPress Popular Posts plugin <= 6.3.2 versions. Vulnerabilidad de Coss-Site Scripting (XSS) autenticada (con permisos de colaboradores o superiores) almacenada en el complemento Hector Cabrera WordPress Popular Posts en versiones <= 6.3.2. The WordPress Popular Posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in versions up to, and including, 6.3.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. • https://patchstack.com/database/vulnerability/wordpress-popular-posts/wordpress-popular-posts-plugin-6-3-2-cross-site-scripting-xss-vulnerability?_s_id=cve • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2022-43468 – WordPress Popular Posts <= 6.0.5 - Unauthenticated Views Changes
https://notcve.org/view.php?id=CVE-2022-43468
External initialization of trusted variables or data stores vulnerability exists in WordPress Popular Posts 6.0.5 and earlier, therefore the vulnerable product accepts untrusted external inputs to update certain internal variables. As a result, the number of views for an article may be manipulated through a crafted input. Vulnerabilidad de inicialización externa de variables confiables o almacenes de datos existe en WordPress Popular Posts 6.0.5 y versiones anteriores, por lo tanto, el producto vulnerable acepta entradas externas que no son confiables para actualizar ciertas variables internas. Como resultado, el número de vistas de un artículo puede manipularse mediante una entrada manipulada. The WordPress Popular Posts plugin for WordPress is vulnerable to Unauthenticated Views Changes in versions up to, and including, 6.0.5. • https://github.com/cabrerahector/wordpress-popular-posts https://jvn.jp/en/jp/JVN13927745/index.html https://wordpress.org/plugins/wordpress-popular-posts • CWE-284: Improper Access Control CWE-665: Improper Initialization •
CVSS: 8.8EPSS: 95%CPEs: 1EXPL: 4CVE-2021-42362 – WordPress Popular Posts <= 5.3.2 Authenticated Arbitrary File Upload
https://notcve.org/view.php?id=CVE-2021-42362
The WordPress Popular Posts WordPress plugin is vulnerable to arbitrary file uploads due to insufficient input file type validation found in the ~/src/Image.php file which makes it possible for attackers with contributor level access and above to upload malicious files that can be used to obtain remote code execution, in versions up to and including 5.3.2. El plugin Popular Posts de WordPress es vulnerable a una carga de archivos arbitrarios debido a la insuficiente comprobación del tipo de archivo de entrada encontrada en el archivo ~/src/Image.php que hace posible que atacantes con acceso de nivel de colaborador y superior carguen archivos maliciosos que pueden ser usados para obtener una ejecución de código remota, en versiones hasta la 5.3.2 incluyéndola • https://www.exploit-db.com/exploits/50129 https://github.com/simonecris/CVE-2021-42362-PoC http://packetstormsecurity.com/files/165376/WordPress-Popular-Posts-5.3.2-Remote-Code-Execution.html https://blog.nintechnet.com/improper-input-validation-fixed-in-wordpress-popular-posts-plugin https://github.com/cabrerahector/wordpress-popular-posts/commit/d9b274cf6812eb446e4103cb18f69897ec6fe601 https://plugins.trac.wordpress.org/changeset/2542638/wordpress-popular-posts/trunk/src/Image.php https://wpscan.com/vulnerability/bd4f157c& • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 0CVE-2021-36872 – WordPress Popular Posts plugin <= 5.3.3 - Authenticated Persistent Cross-Site Scripting (XSS) vulnerability
https://notcve.org/view.php?id=CVE-2021-36872
Authenticated Persistent Cross-Site Scripting (XSS) vulnerability in WordPress Popular Posts plugin (versions <= 5.3.3). Vulnerable at &widget-wpp[2][post_type]. Una vulnerabilidad de tipo Cross-Site Scripting (XSS) Persistente Autenticado en el plugin Popular Posts de WordPress (versiones anteriores a 5.3.3, incluyéndola). Vulnerable en &widget-wpp[2][post_type] • https://github.com/cabrerahector/wordpress-popular-posts/blob/master/changelog.md https://patchstack.com/database/vulnerability/wordpress-popular-posts/wordpress-popular-posts-plugin-5-3-3-authenticated-persistent-cross-site-scripting-xss-vulnerability • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 0CVE-2021-20746 – WordPress Popular Posts <= 5.3.2 - Authenticated Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2021-20746
Cross-site scripting vulnerability in WordPress Popular Posts 5.3.2 and earlier allows a remote authenticated attacker to inject an arbitrary script via unspecified vectors. Una vulnerabilidad de tipo cross-site scripting en WordPress Popular Posts versiones 5.3.2 y anteriores, permite a un atacante remoto autenticado inyectar un script arbitrario por medio de vectores no especificados • https://cabrerahector.com https://cabrerahector.com/wordpress/wordpress-popular-posts-5-3-improved-php-8-support-retina-display-support-and-more/#minor-updates-and-hotfixes https://jvn.jp/en/jp/JVN63066062/index.html https://wordpress.org/plugins/wordpress-popular-posts • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •