CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 3CVE-2021-24287 – Select All Categories and Taxonomies < 1.3.2 - Reflected Cross-Site Scripting (XSS)
https://notcve.org/view.php?id=CVE-2021-24287
The settings page of the Select All Categories and Taxonomies, Change Checkbox to Radio Buttons WordPress plugin before 1.3.2 did not properly sanitise the tab parameter before outputting it back, leading to a reflected Cross-Site Scripting issue La página de configuración del plugin de WordPress Select All Categories and Taxonomies, Change Checkbox to Radio Buttons versiones anteriores a 1.3.2, no sanea apropiadamente el parámetro tab antes de devolverlo, conllevando a un problema de tipo Cross-Site Scripting reflejado The settings page of the Select All Categories and Taxonomies, Change Checkbox to Radio Buttons WordPress plugin before 1.3.2 did not properly sanitise the tab parameter before outputting it back, leading to a reflected Cross-Site Scripting issue. WordPress Select All Categories And Taxonomies plugin version 1.3.1 suffers from a cross site scripting vulnerability. • https://www.exploit-db.com/exploits/50349 http://packetstormsecurity.com/files/164327/WordPress-Select-All-Categories-And-Taxonomies-1.3.1-Cross-Site-Scripting.html https://wpscan.com/vulnerability/56e1bb56-bfc5-40dd-b2d0-edef43d89bdf • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.1EPSS: 33%CPEs: 1EXPL: 1CVE-2020-24148 – Import XML and RSS Feeds <= 2.0.2 - Server-Side Request Forgery
https://notcve.org/view.php?id=CVE-2020-24148
Server-side request forgery (SSRF) in the Import XML and RSS Feeds (import-xml-feed) plugin 2.0.1 for WordPress via the data parameter in a moove_read_xml action. Una vulnerabilidad de tipo Server-side request forgery (SSRF) en el plugin Import XML and RSS Feeds (import-xml-feed) versión 2.0.1 para WordPress, por medio del parámetro data en una acción moove_read_xml The Import XML and RSS Feeds plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including, 2.0.2 via the data parameter in a moove_read_xml action. • https://github.com/dwisiswant0/CVE-2020-24148 https://github.com/secwx/research/blob/main/cve/CVE-2020-24148.md https://wordpress.org/plugins/import-xml-feed/#developers • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 2CVE-2021-24247 – Contact Form Check Tester <= 1.0.2 - Broken Access Control to Cross-Site Scripting (XSS)
https://notcve.org/view.php?id=CVE-2021-24247
The Contact Form Check Tester WordPress plugin through 1.0.2 settings are visible to all registered users in the dashboard and are lacking any sanitisation. As a result, any registered user, such as subscriber, can leave an XSS payload in the plugin settings, which will be triggered by any user visiting them, and could allow for privilege escalation. The vendor decided to close the plugin. La configuración del plugin Contact Form Check Tester WordPress versiones hasta 1.0.2, es visible para todos los usuarios registrados en el tablero y carece de saneamiento. Como resultado, cualquier usuario registrado, como el suscriptor, puede dejar una carga útil XSS en la configuración del plugin, que será activada por cualquier usuario que los visite y podría permitir una escalada de privilegios. • https://www.exploit-db.com/exploits/50703 https://wpscan.com/vulnerability/e2990a7a-d4f0-424e-b01d-ecf67cf9c9f3 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 1CVE-2019-25143 – GDPR Cookie Compliance <= 4.0.2 - Missing Authorization
https://notcve.org/view.php?id=CVE-2019-25143
The GDPR Cookie Compliance plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the gdpr_cookie_compliance_reset_settings AJAX action in versions up to, and including, 4.0.2. This makes it possible for authenticated attackers to reset all of the settings. • https://blog.nintechnet.com/wordpress-gdpr-cookie-compliance-plugin-fixed-authenticated-settings-deletion-vulnerability https://wpscan.com/vulnerability/5ac51325-a7f5-4d38-9b41-61855206083d https://www.acunetix.com/vulnerabilities/web/wordpress-plugin-gdpr-cookie-compliance-security-bypass-4-0-2 https://www.wordfence.com/threat-intel/vulnerabilities/id/9116d719-f536-4b8a-9e73-9a8a922f8a35?source=cve • CWE-862: Missing Authorization •