CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2024-29804 – WordPress Fancy Comments WordPress plugin <= 1.2.14 - Cross Site Scripting (XSS) vulnerability
https://notcve.org/view.php?id=CVE-2024-29804
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Team Heateor Fancy Comments WordPress allows Stored XSS.This issue affects Fancy Comments WordPress: from n/a through 1.2.14. Neutralización inadecuada de la entrada durante la vulnerabilidad de generación de páginas web ('Cross-site Scripting') en Team Heate o Fancy Comments WordPress permite XSS almacenado. Este problema afecta a Fancy Comments WordPress: desde n/a hasta 1.2.14. The Fancy Comments WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's facebook_comments_shortcode shortcode function in all versions up to, and including, 1.2.14 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. • https://patchstack.com/database/vulnerability/fancy-facebook-comments/wordpress-fancy-comments-wordpress-plugin-1-2-14-cross-site-scripting-xss-vulnerability?_s_id=cve • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2023-48740 – Easy Social Feed <= 6.5.1 - Missing Authorization via hide_free_sidebar()
https://notcve.org/view.php?id=CVE-2023-48740
The Easy Social Feed plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the hide_free_sidebar() function in versions up to, and including, 6.5.1. This makes it possible for authenticated attackers, with subscriber-level access and above, to dismiss a sidebar notification. • CWE-862: Missing Authorization •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 0CVE-2022-0209 – Mitsol Social Post Feed < 1.11 - Admin+ Stored Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2022-0209
The Mitsol Social Post Feed WordPress plugin before 1.11 does not escape some of its settings before outputting them back in attributes, which could allow high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed El plugin de WordPress Mitsol Social Post Feed antes de la versión 1.11 no escapa de algunas de sus configuraciones antes de devolverlas en atributos, lo que podría permitir a los usuarios con altos privilegios, como los administradores, realizar ataques de Cross-Site Scripting incluso cuando la capacidad unfiltered_html está deshabilitada The Mitsol Social Post Feed plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.10 due to insufficient input sanitization and output escaping on the application id parameters. This makes it possible for authenticated (admin+) attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html is disabled. • https://wpscan.com/vulnerability/1e4af9be-5c88-4a3e-89ff-dd2b1bc131fe • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.1EPSS: 0%CPEs: 1EXPL: 2CVE-2021-24217 – Facebook for WordPress < 3.0.0 - PHP Object Injection with POP Chain
https://notcve.org/view.php?id=CVE-2021-24217
The run_action function of the Facebook for WordPress plugin before 3.0.0 deserializes user supplied data making it possible for PHP objects to be supplied creating an Object Injection vulnerability. There was also a useable magic method in the plugin that could be used to achieve remote code execution. La función run_action del plugin de Facebook para WordPress versiones anteriores a 3.0.0, deserializa unos datos suministrados por el usuario, haciendo posible que sean suministrados objetos PHP creando una vulnerabilidad de Inyección de Objetos. También había un método mágico usable en el plugin que podía ser usado para lograr una ejecución de código remota • https://wpscan.com/vulnerability/509f2754-a1a1-4142-9126-ae023a88533a https://www.wordfence.com/blog/2021/03/two-vulnerabilities-patched-in-facebook-for-wordpress-plugin • CWE-502: Deserialization of Untrusted Data •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 2CVE-2021-24218 – Facebook for WordPress 3.0.0-3.0.3 - CSRF to Stored XSS and Settings Deletion
https://notcve.org/view.php?id=CVE-2021-24218
The wp_ajax_save_fbe_settings and wp_ajax_delete_fbe_settings AJAX actions of the Facebook for WordPress plugin before 3.0.4 were vulnerable to CSRF due to a lack of nonce protection. The settings in the saveFbeSettings function had no sanitization allowing for script tags to be saved. Las acciones AJAX wp_ajax_save_fbe_settings y wp_ajax_delete_fbe_settings del plugin de Facebook para WordPress versiones anteriores a 3.0.4, eran vulnerables a un ataque de tipo CSRF debido a una falta de protección nonce. La configuración de la función saveFbeSettings no tenía saneamiento, permitiendo a unas etiquetas de script sean guardadas • https://wpscan.com/vulnerability/169d21fc-d191-46ff-82e8-9ac887aed8a4 https://www.wordfence.com/blog/2021/03/two-vulnerabilities-patched-in-facebook-for-wordpress-plugin • CWE-352: Cross-Site Request Forgery (CSRF) •