CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 1CVE-2024-1279 – Paid Memberships Pro < 2.12.9 - Contributor+ Arbitrary User Custom Field Disclosure
https://notcve.org/view.php?id=CVE-2024-1279
The Paid Memberships Pro WordPress plugin before 2.12.9 does not prevent user with at least the contributor role from leaking other users' sensitive metadata. El complemento Paid Memberships Pro de WordPress anterior a 2.12.9 no impide que el usuario con al menos el rol de colaborador filtre metadatos confidenciales de otros usuarios. The Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.12.8. This makes it possible for authenticated attackers, with contributor-level access and above, to extract user meta data utilizing the pmpro_member shortcode. • https://wpscan.com/vulnerability/4c537264-0c23-428e-9a11-7a9e74fb6b69 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 1CVE-2024-1487 – Photos and Files Contest Gallery < 21.3.1 - Author+ Stored Cross Site Scripting
https://notcve.org/view.php?id=CVE-2024-1487
The Photos and Files Contest Gallery WordPress plugin before 21.3.1 does not sanitize and escape some parameters, which could allow users with a role as low as author to perform Cross-Site Scripting attacks. El complemento de WordPress de Photos and Files Contest Gallery anterior a 21.3.1 no sanitiza ni escapa a algunos parámetros, lo que podría permitir a los usuarios con un rol tan bajo como el de autor realizar ataques de Cross-Site Scripting. The Photos and Files Contest Gallery – Contact Form, Upload Form, Social Share and Voting Competition Plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 21.3.0 due to insufficient input sanitization and output escaping on content descriptions. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. • https://wpscan.com/vulnerability/c028cd73-f30a-4c8b-870f-3071055f0496 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 1CVE-2024-0561 – Ultimate Posts Widget < 2.3.1 - Admin+ Stored XSS
https://notcve.org/view.php?id=CVE-2024-0561
The Ultimate Posts Widget WordPress plugin before 2.3.1 does not validate and escape some of its Widget options before outputting them back in attributes, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) El complemento de WordPress Ultimate Posts Widget anterior a 2.3.1 no valida ni escapa algunas de sus opciones de widget antes de devolverlas en atributos, lo que podría permitir a usuarios con altos privilegios, como el administrador, realizar ataques de Cross-Site Scripting Almacenado incluso cuando la capacidad unfiltered_html no está permitida (por ejemplo, en una configuración multisitio) The Ultimate Posts Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.3.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. • https://wpscan.com/vulnerability/99b6aa8b-deb9-48f8-8896-f3c8118a4f70 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 1CVE-2024-1273 – Starbox < 3.5.0 - Contributor+ Stored XSS
https://notcve.org/view.php?id=CVE-2024-1273
The Starbox WordPress plugin before 3.5.0 does not sanitise and escape some parameters, which could allow users with a role as low as Contributor to perform Cross-Site Scripting attacks El complemento Starbox de WordPress anterior a 3.5.0 no sanitiza ni escapa a algunos parámetros, lo que podría permitir a usuarios con un rol tan bajo como Colaborador realizar ataques de cross-site scripting The Starbox – the Author Box for Humans plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 3.4.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. • https://wpscan.com/vulnerability/9784d7c8-e3aa-42af-ace8-5b2b37ebc9cb • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 1CVE-2024-1274 – My Calendar < 3.4.24 - Authenticated Stored XSS
https://notcve.org/view.php?id=CVE-2024-1274
The My Calendar WordPress plugin before 3.4.24 does not sanitise and escape some parameters, which could allow users with a role as low as Subscriber to perform Cross-Site Scripting attacks (depending on the permissions set by the admin) El complemento My Calendar de WordPress anterior a la versión 3.4.24 no desinfecta ni escapa a algunos parámetros, lo que podría permitir a los usuarios con un rol tan bajo como Suscriptor realizar ataques de cross-site scripting (dependiendo de los permisos establecidos por el administrador). The My Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via events in all versions up to, and including, 3.4.23 due to insufficient input sanitization and output escaping on event dates. This makes it possible for authenticated attackers with, admin-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. • https://wpscan.com/vulnerability/91dba45b-9930-4bfb-a7bf-903c46864e9f • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •