CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2022-36389 – WordPress Better Messages plugin <= 1.9.9.148 - Cross-Site Request Forgery (CSRF) vulnerability
https://notcve.org/view.php?id=CVE-2022-36389
Cross-Site Request Forgery (CSRF) vulnerability in WordPlus Better Messages plugin <= 1.9.9.148 at WordPress. Una vulnerabilidad de tipo Cross-Site Request Forgery (CSRF) en el plugin WordPlus Better Messages versiones anteriores a 1.9.9.148 incluyéndola, en WordPress. The Better Messages plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.9.9.148. This is due to missing or incorrect nonce validation on the bp_messages_favorite action. This makes it possible for unauthenticated attackers to trigger this action granted they can trick a site administrator into performing an action such as clicking on a link. • https://patchstack.com/database/vulnerability/bp-better-messages/wordpress-better-messages-plugin-1-9-9-148-cross-site-request-forgery-csrf-vulnerability-2 https://wordpress.org/plugins/bp-better-messages/#developers • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2021-24808 – BP Better Messages < 1.9.9.41 - Reflected Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2021-24808
The BP Better Messages WordPress plugin before 1.9.9.41 sanitise (with sanitize_text_field) but does not escape the 'subject' parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting issue El plugin BP Better Messages de WordPress versiones anteriores a 1.9.9.41, sanea (con sanitize_text_field) pero no escapa el parámetro "subject" antes de devolverlo en un atributo, conllevando un problema de tipo Cross-Site Scripting Reflejado • https://plugins.trac.wordpress.org/changeset/2605772/bp-better-messages/trunk/views/layout-new.php https://wpscan.com/vulnerability/53ff82ec-00ec-4b20-8f60-db9db8c025b4 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 1CVE-2021-24809 – BP Better Messages < 1.9.9.41 - Multiple CSRF
https://notcve.org/view.php?id=CVE-2021-24809
The BP Better Messages WordPress plugin before 1.9.9.41 does not check for CSRF in multiple of its AJAX actions: bp_better_messages_leave_chat, bp_better_messages_join_chat, bp_messages_leave_thread, bp_messages_mute_thread, bp_messages_unmute_thread, bp_better_messages_add_user_to_thread, bp_better_messages_exclude_user_from_thread. This could allow attackers to make logged in users do unwanted actions El plugin BP Better Messages de WordPress versiones anteriores a 1.9.9. 41 no comprueba el CSRF en varias de sus acciones AJAX: bp_better_messages_leave_chat, bp_better_messages_join_chat, bp_messages_leave_thread, bp_messages_mute_thread, bp_messages_unmute_thread, bp_better_messages_add_user_to_thread, bp_better_messages_exclude_user_from_thread. Esto podría permitir a atacantes hacer que usuarios conectados realicen acciones no deseadas • https://plugins.trac.wordpress.org/changeset/2605772/bp-better-messages/trunk/inc/ajax.php https://wpscan.com/vulnerability/e186fef4-dca0-461f-b539-082c13a68d13 • CWE-352: Cross-Site Request Forgery (CSRF) •