CVSS: 7.2EPSS: 0%CPEs: 1EXPL: 0CVE-2022-45831 – WordPress Image Hover Effects - Caption Hover with Carousel Plugin <= 2.8 is vulnerable to Cross Site Scripting (XSS)
https://notcve.org/view.php?id=CVE-2022-45831
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in biplob018 Image Hover Effects for Elementor with Lightbox and Flipbox plugin <= 2.8 versions. The Image Hover Effects plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. • https://patchstack.com/database/vulnerability/image-hover-effects-with-carousel/wordpress-image-hover-effects-caption-hover-with-carousel-plugin-2-8-cross-site-scripting-xss?_s_id=cve • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 0CVE-2022-4207 – Image Hover Effects Ultimate 9.8.1 - 9.8.4 - Authenticated (Admin+) Stored Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2022-4207
The Image Hover Effects Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several values that can be added to an Image Hover in versions 9.8.1 to 9.8.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. By default, the plugin only allows administrators access to edit Image Hovers, however, if a site admin makes the plugin's features available to lower privileged users through the 'Who Can Edit?' setting then this can be exploited by those users. Image Hover Effects Ultimate complemento para WordPress es vulnerable a Cross-Site Scripting Almacenado a través de varios valores que se pueden agregar a Image Hover en las versiones 9.8.1 a 9.8.4 debido a una sanitización de entrada y un escape de salida insuficientes. • https://github.com/MrOxizen/image-hover-effects-ultimate/commit/4ba784e1a2a0cf02e8b8cbe3db7323735d7dedc9 https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2830197%40image-hover-effects-ultimate&new=2830197%40image-hover-effects-ultimate&sfp_email=&sfph_mail= https://www.wordfence.com/threat-intel/vulnerabilities/id/f00cdef3-d733-4e85-8099-204ef76096b4 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.2EPSS: 0%CPEs: 1EXPL: 0CVE-2022-42459 – WordPress Image Hover Effects Ultimate plugin <= 9.7.1 - Auth. WordPress Options Change vulnerability
https://notcve.org/view.php?id=CVE-2022-42459
Auth. WordPress Options Change vulnerability in Image Hover Effects Ultimate plugin <= 9.7.1 on WordPress. Vulnerabilidad de cambio de opciones de WordPress autenticada en el complemento Image Hover Effects Ultimate en WordPress en versiones <= 9.7.1. The Image Hover Effects Ultimate plugin for WordPress is vulnerable to Arbitrary Options Update in versions up to, and including, 9.7.1. This is due to a lack of validation on the settings supplied to the post_oxi_settings() function. • https://patchstack.com/database/vulnerability/image-hover-effects-ultimate/wordpress-image-hover-effects-ultimate-plugin-9-7-1-auth-wordpress-options-change-vulnerability?_s_id=cve https://wordpress.org/plugins/image-hover-effects-ultimate • CWE-264: Permissions, Privileges, and Access Controls CWE-269: Improper Privilege Management CWE-639: Authorization Bypass Through User-Controlled Key •
CVSS: 7.2EPSS: 0%CPEs: 1EXPL: 0CVE-2022-38104 – WordPress Accordions plugin <= 2.0.3 - Auth. WordPress Options Change vulnerability
https://notcve.org/view.php?id=CVE-2022-38104
Auth. WordPress Options Change (siteurl, users_can_register, default_role, admin_email and new_admin_email) vulnerability in Biplob Adhikari's Accordions – Multiple Accordions or FAQs Builder plugin (versions <= 2.0.3 on WordPress. Una vulnerabilidad de Cambio de opciones autenticadas de WordPress (siteurl, users_can_register, default_role, admin_email y new_admin_email) vulnerabilidad en el plugin Accordions - Multiple Accordions o FAQs Builder de Biplob Adhikari (versiones anteriores a 2.0.3 incluyéndola) en WordPress The Accordions plugin for WordPress is vulnerable to arbitrary options update in versions up to, and including, 2.0.3. This is due to insufficient capability checking on the manual_import_json() function. This makes it possible for authenticated attackers to modify arbitrary options on the site and can be used for complete site takeover. • https://patchstack.com/database/vulnerability/accordions-or-faqs/wordpress-accordions-plugin-2-0-3-authenticated-wordpress-options-change-vulnerability?_s_id=cve https://wordpress.org/plugins/accordions-or-faqs/#developers • CWE-264: Permissions, Privileges, and Access Controls CWE-862: Missing Authorization •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 0CVE-2022-45082 – WordPress Accordions plugin <= 2.0.3 - Multiple Auth. Stored Cross-Site Scripting (XSS) vulnerabilities
https://notcve.org/view.php?id=CVE-2022-45082
Multiple Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerabilities in Accordions plugin <= 2.0.3 on WordPress via &addons-style-name and &accordions_or_faqs_license_key. Vulnerabilidad de Coss-Site Scripting (XSS) de autenticación múltiple (con permisos de admin o superiores) almacenada en el complemento Accordions en WordPress en versiones <= 2.0.3 a través de &addons-style-name y &accordions_or_faqs_license_key. The Accordions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘license’ parameter used in the post_oxi_license function for the API class in versions up to, and including, 2.0.3 due to insufficient input sanitization and output escaping. This makes it possible for administrator-level attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page • https://patchstack.com/database/vulnerability/accordions-or-faqs/wordpress-accordions-plugin-2-0-3-multiple-auth-stored-cross-site-scripting-xss-vulnerabilities?_s_id=cve https://wordpress.org/plugins/accordions-or-faqs/#developers • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •