CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2023-29440 – WordPress Simple Job Board Plugin <= 2.10.3 is vulnerable to Cross Site Request Forgery (CSRF)
https://notcve.org/view.php?id=CVE-2023-29440
Cross-Site Request Forgery (CSRF) vulnerability in PressTigers Simple Job Board plugin <= 2.10.3 versions. Vulnerabilidad de Cross-Site Request Forgery (CSRF) en el complemento PressTigers Simple Job Board en versiones <= 2.10.3. The Simple Job Board plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.10.3. This is due to missing or incorrect nonce validation on the sjb_save_settings_section function. This makes it possible for unauthenticated attackers to save plugin settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. • https://patchstack.com/database/vulnerability/simple-job-board/wordpress-simple-job-board-plugin-2-10-3-cross-site-request-forgery-csrf?_s_id=cve • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 1CVE-2022-2558 – Simple Job Board < 2.10.0 - Resume Disclosure via Directory Listing
https://notcve.org/view.php?id=CVE-2022-2558
The Simple Job Board WordPress plugin before 2.10.0 is susceptible to Directory Listing which allows the public listing of uploaded resumes in certain configurations. El plugin Simple Job Board de WordPress versiones anteriores a 2.10.0, es susceptible de ser listado en el directorio, lo que permite el listado público de los currículos subidos en determinadas configuraciones. The plugin Simple Job Board for WordPress is vulnerable to Information Disclosure in versions up to, and including, 2.9.6. This makes it possible for attackers do extract sensitive information such as resumes. • https://wpscan.com/vulnerability/6e096269-eedc-4614-88ce-6795c4adf32f • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0CVE-2022-25611 – WordPress Simple Event Planner plugin <= 1.5.4 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability
https://notcve.org/view.php?id=CVE-2022-25611
Authenticated Stored Cross-Site Scripting (XSS) in Simple Event Planner plugin <= 1.5.4 allows attackers with contributor or higher user roles to inject the malicious script by using vulnerable parameter &custom[add_seg][]. Una vulnerabilidad de tipo Cross-Site Scripting (XSS) Almacenado y Autenticado en el plugin Simple Event Planner versiones anteriores a 1.5.4 incluyéndola, permite a atacantes con roles de usuario contributor o superior inyectar el script malicioso mediante el parámetro vulnerable &custom[add_seg][] The Simple Event Planner plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘&custom[add_seg][]’ parameter in versions up to, and including, 1.5.4 due to insufficient input sanitization and output escaping. This makes it possible for Contributor-level attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. • https://patchstack.com/database/vulnerability/simple-event-planner/wordpress-simple-event-planner-plugin-1-5-4-authenticated-stored-cross-site-scripting-xss-vulnerability https://wordpress.org/plugins/simple-event-planner/#developers • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0CVE-2022-25612 – WordPress Simple Event Planner plugin <= 1.5.4 - Multiple Authenticated Persistent Cross-Site Scripting (XSS) vulnerabilities
https://notcve.org/view.php?id=CVE-2022-25612
Multiple Authenticated Persistent Cross-Site Scripting (XSS) vulnerabilities in Simple Event Planner WordPress plugin <= 1.5.4 allows user with author or higher user rights inject the malicious code via vulnerable parameters: &custom[event_organiser], &custom[organiser_email], &custom[organiser_contact]. Múltiples vulnerabilidades de tipo Cross-Site Scripting (XSS) Persistente Autenticado en el plugin Simple Event Planner de WordPress versiones anteriores a 1.5.4 incluyéndola, permite al usuario con derechos de autor o superior inyectar el código malicioso por medio de los parámetros vulnerables: &custom[event_organiser], &custom[organiser_email], &custom[organiser_contact] • https://patchstack.com/database/vulnerability/simple-event-planner/wordpress-simple-event-planner-plugin-1-5-4-multiple-authenticated-persistent-cross-site-scripting-xss-vulnerabilities https://wordpress.org/plugins/simple-event-planner/#developers • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 1CVE-2021-39328 – Simple Job Board <= 2.9.4 Authenticated Stored Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2021-39328
The Simple Job Board WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient escaping on the $job_board_privacy_policy_label variable echo'd out via the ~/admin/settings/class-simple-job-board-settings-privacy.php file which allowed attackers with administrative user access to inject arbitrary web scripts, in versions up to and including 2.9.4. This affects multi-site installations where unfiltered_html is disabled for administrators, and sites where unfiltered_html is disabled. El plugin Simple Job Board de WordPress es vulnerable a un ataque de tipo Cross-Site Scripting Almacenado debido a un escape insuficiente en la variable $job_board_privacy_policy_label que se hace eco por medio del archivo ~/admin/settings/class-simple-job-board-settings-privacy.php que permite a atacantes con acceso de usuario administrativo inyectar scripts web arbitrarios, en versiones hasta la 2.9.4 incluyéndola. Esto afecta a las instalaciones multisitio donde unfiltered_html está deshabilitado para los administradores, y los sitios donde unfiltered_html está deshabilitado • https://github.com/BigTiger2020/word-press/blob/main/Simple%20Job%20Board%E2%80%94Stored%20Cross-Site%20Scripting%20-%202.md https://plugins.trac.wordpress.org/changeset/2617364/simple-job-board/trunk/admin/settings/class-simple-job-board-settings-privacy.php https://www.wordfence.com/vulnerability-advisories/#CVE-2021-39328 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •