CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2022-41790 – WordPress WP Time Slots Booking Form Plugin <= 1.1.76 is vulnerable to Broken Access Control
https://notcve.org/view.php?id=CVE-2022-41790
Missing Authorization vulnerability in CodePeople WP Time Slots Booking Form.This issue affects WP Time Slots Booking Form: from n/a through 1.1.76. Vulnerabilidad de autorización faltante en CodePeople WP Time Slots Booking Form. Este problema afecta a WP Time Slots Booking Form: desde n/a hasta 1.1.76. The WP Time Slots Booking Form plugin for WordPress is vulnerable to unauthorized access of functionality due to a missing capability check on the cptslotsb_feedback function in versions up to, and including, 1.1.76. This makes it possible for authenticated attackers with subscriber access or higher to submit plugin feedback on behalf of the site owner. • https://patchstack.com/database/vulnerability/wp-time-slots-booking-form/wordpress-wp-time-slots-booking-form-plugin-1-1-76-missing-authorization-leading-to-feedback-submission-vulnerability • CWE-862: Missing Authorization •
CVSS: 4.8EPSS: 0%CPEs: 1EXPL: 1CVE-2023-0389 – Calculated Fields Form < 1.1.151 - Admin+ Stored Cross-Site Scripting via Dropdown Fields
https://notcve.org/view.php?id=CVE-2023-0389
The Calculated Fields Form WordPress plugin before 1.1.151 does not sanitise and escape some of its form settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) El complemento de WordPress Calculated Fields Form anterior a 1.1.151 no sanitiza ni escapa a algunas de sus configuraciones de formulario, lo que podría permitir a usuarios con altos privilegios, como el administrador, realizar ataques de cross site scripting almacenado incluso cuando la capacidad unfiltered_html no está permitida (por ejemplo, en configuración multisitio). The Calculated Fields Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 1.1.150 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. • https://wpscan.com/vulnerability/090a3922-febc-4294-82d2-d8339d461893 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2023-25039 – WordPress Google Maps CP plugin <= 1.0.43 - Missing Authorization Leading To Feedback Submission Vulnerability
https://notcve.org/view.php?id=CVE-2023-25039
Missing Authorization vulnerability in CodePeople Google Maps CP.This issue affects Google Maps CP: from n/a through 1.0.43. Vulnerabilidad de autorización faltante en CodePeople Google Maps CP. Este problema afecta a Google Maps CP: desde n/a hasta 1.0.43. The Google Maps CP plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the feedback_action function called via the cp-google-maps-feedback action in versions up to, and including, 1.0.43. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to perform an unauthorized feedback form submission. • https://patchstack.com/database/vulnerability/codepeople-post-map/wordpress-google-maps-cp-plugin-1-0-43-missing-authorization-leading-to-feedback-submission-vulnerability?_s_id=cve • CWE-862: Missing Authorization •
CVSS: 5.9EPSS: 0%CPEs: 1EXPL: 0CVE-2023-23971 – WordPress WP Time Slots Booking Form Plugin <= 1.1.81 is vulnerable to Cross Site Scripting (XSS)
https://notcve.org/view.php?id=CVE-2023-23971
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in CodePeople WP Time Slots Booking Form plugin <= 1.1.81 versions. The WP Time Slots Booking Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 1.1.81 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrative-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. • https://patchstack.com/database/vulnerability/wp-time-slots-booking-form/wordpress-wp-time-slots-booking-form-plugin-1-1-81-cross-site-scripting-xss?_s_id=cve • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2022-43482 – WordPress Appointment Booking Calendar plugin <= 1.3.69 - Missing Authorization vulnerability
https://notcve.org/view.php?id=CVE-2022-43482
Missing Authorization vulnerability in Appointment Booking Calendar plugin <= 1.3.69 on WordPress. Vulnerabilidad de autorización faltante en el complemento Appointment Booking Calendar en WordPress en versiones <= 1.3.69. The Appointment Booking Calendar plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the cpabcal_feedback() function in versions up to, and including, 1.3.69. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to submit plugin feedback. This can also be exploited via CSRF due to missing nonce validation. • https://patchstack.com/database/vulnerability/appointment-booking-calendar/wordpress-appointment-booking-calendar-plugin-1-3-69-missing-authorization-vulnerability?_s_id=cve • CWE-862: Missing Authorization •