CVSS: 5.3EPSS: 0%CPEs: 24EXPL: 0CVE-2022-43504 – WordPress Core < 6.0.3 - Information Disclosure (Email Address)
https://notcve.org/view.php?id=CVE-2022-43504
Improper authentication vulnerability in WordPress versions prior to 6.0.3 allows a remote unauthenticated attacker to obtain the email address of the user who posted a blog using the WordPress Post by Email Feature. The developer also provides new patched releases for all versions since 3.7. Una vulnerabilidad de autenticación inadecuada en las versiones de WordPress anteriores a la 6.0.3 permite que un atacante remoto no autenticado obtenga la dirección de correo electrónico del usuario que publicó un blog utilizando WordPress Post by Email Feature. El desarrollador también proporciona nuevas versiones parcheadas para todas las versiones desde la 3.7. WordPress Core is vulnerable to Information Disclosure of in versions up to 6.0.3. • https://jvn.jp/en/jp/JVN09409909/index.html https://wordpress.org/download https://wordpress.org/news/2022/10/wordpress-6-0-3-security-release • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-287: Improper Authentication •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 0CVE-2022-2944 – WordPress Countdown Widget <= 3.1.9.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2022-2944
The WordPress Countdown Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several parameters in versions up to, and including, 3.1.9.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.9EPSS: 0%CPEs: 2EXPL: 4CVE-2022-3590 – WP <= 6.1.1 - Unauthenticated Blind SSRF via DNS Rebinding
https://notcve.org/view.php?id=CVE-2022-3590
WordPress is affected by an unauthenticated blind SSRF in the pingback feature. Because of a TOCTOU race condition between the validation checks and the HTTP request, attackers can reach internal hosts that are explicitly forbidden. WordPress se ve afectado por blind SSRF no autenticado en la función de pingback. Debido a una condición de ejecución TOCTOU entre las comprobaciones de validación y la solicitud HTTP, los atacantes pueden llegar a hosts internos que están explícitamente prohibidos. WordPress Core, in all known versions is vulnerable to blind Server-Side Request Forgery in its pingback feature. • https://github.com/hxlxmjxbbxs/CVE-2022-3590-WordPress-Vulnerability-Scanner https://github.com/huynhvanphuc/CVE-2022-3590-WordPress-Vulnerability-Scanner https://blog.sonarsource.com/wordpress-core-unauthenticated-blind-ssrf https://wpscan.com/vulnerability/c8814e6e-78b3-4f63-a1d3-6906a84c1f11 • CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2022-45847 – WordPress Countdown Widget plugin <= 3.1.9.1 - Cross-Site Request Forgery (CSRF) leading to Cross-Site Scripting (XSS)
https://notcve.org/view.php?id=CVE-2022-45847
Cross-Site Request Forgery (CSRF) vulnerability in WPAssist.Me WordPress Countdown Widget allows Cross-Site Scripting (XSS).This issue affects WordPress Countdown Widget: from n/a through 3.1.9.1. Vulnerabilidad de Cross-Site Request Forgery (CSRF) en WPAssist.Me WordPress Countdown Widget permite cross-site scripting (XSS). Este problema afecta al widget de cuenta regresiva de WordPress: desde n/a hasta 3.1.9.1. The WordPress Countdown Widget plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.1.9.1. This is due to missing or incorrect nonce validation on the admin_header function. • https://patchstack.com/database/vulnerability/wordpress-countdown-widget/wordpress-countdown-widget-plugin-3-1-9-1-cross-site-request-forgery-csrf-leading-to-cross-site-scripting-xss?_s_id=cve • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 4.9EPSS: 0%CPEs: 25EXPL: 0CVE-2022-4973 – WordPress Core < 6.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via use of the_meta(); function
https://notcve.org/view.php?id=CVE-2022-4973
WordPress Core, in versions up to 6.0.2, is vulnerable to Authenticated Stored Cross-Site Scripting that can be exploited by users with access to the WordPress post and page editor, typically consisting of Authors, Contributors, and Editors making it possible to inject arbitrary web scripts into posts and pages that execute if the the_meta(); function is called on that page. • https://www.wordfence.com/threat-intel/vulnerabilities/id/b5582e89-83e6-4898-b9fe-09eddeb5f7ae?source=cve https://core.trac.wordpress.org/changeset/53961 https://wordpress.org/news/2022/08/wordpress-6-0-2-security-and-maintenance-release https://www.wordfence.com/blog/2022/08/wordpress-core-6-0-2-security-maintenance-release-what-you-need-to-know • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •