CVSS: 9.0EPSS: 0%CPEs: 1EXPL: 0CVE-2023-3636 – WP Project Manager <= 2.6.4 - Arbitrary Usermeta Update to Authenticated (Subscriber+) Privilege Escalation
https://notcve.org/view.php?id=CVE-2023-3636
24 Jul 2023 — The WP Project Manager plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 2.6.4 due to insufficient restriction on the 'save_users_map_name' function. This makes it possible for authenticated attackers, with minimal permissions such as a subscriber, to modify their user role by supplying the 'usernames' parameter. WordPress WP Project Manager plugin versions 2.6.4 and below suffer from a privilege escalation vulnerability. • https://plugins.trac.wordpress.org/browser/wedevs-project-manager/tags/2.6.3/src/User/Controllers/User_Controller.php#L158 • CWE-269: Improper Privilege Management •
CVSS: 9.0EPSS: 0%CPEs: 1EXPL: 0CVE-2023-34382 – WordPress Dokan Plugin <= 3.7.19 is vulnerable to PHP Object Injection
https://notcve.org/view.php?id=CVE-2023-34382
07 Jun 2023 — Deserialization of Untrusted Data vulnerability in weDevs Dokan – Best WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy.This issue affects Dokan – Best WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy: from n/a through 3.7.19. Vulnerabilidad de deserialización de datos no confiables en weDevs Dokan – Best WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy. Este problema afecta a Dokan – Best WooCommerce Multivendor... • https://patchstack.com/database/vulnerability/dokan-lite/wordpress-dokan-plugin-3-7-19-php-object-injection-vulnerability?_s_id=cve • CWE-502: Deserialization of Untrusted Data •
CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 1CVE-2023-2743 – WP ERP < 1.12.4 - Reflected Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2023-2743
05 Jun 2023 — The ERP WordPress plugin before 1.12.4 does not sanitise and escape the employee_name parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin. The WP ERP plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'employee_name' parameter in versions up to, and including, 1.12.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers t... • https://wpscan.com/vulnerability/517c6aa4-a56d-4f13-b370-7c864dd9c7db • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.3EPSS: 0%CPEs: 1EXPL: 3CVE-2023-2744 – WP ERP < 1.12.4 - Admin+ SQL Injection
https://notcve.org/view.php?id=CVE-2023-2744
05 Jun 2023 — The ERP WordPress plugin before 1.12.4 does not properly sanitise and escape the `type` parameter in the `erp/v1/accounting/v1/people` REST API endpoint before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin. The WP ERP plugin for WordPress is vulnerable to SQL Injection via the 'type' parameter in versions up to 1.12.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes... • https://github.com/pashayogi/CVE-2023-2744 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 7.1EPSS: 0%CPEs: 1EXPL: 1CVE-2023-34008 – WordPress WP ERP Plugin <= 1.12.3 is vulnerable to Cross Site Scripting (XSS)
https://notcve.org/view.php?id=CVE-2023-34008
02 Jun 2023 — Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in weDevs WP ERP plugin <= 1.12.3 versions. Vulnerabilidad de Cross-Site Scripting (XSS) Reflejado en el plugin WP ERP de weDevs que afecta a versiones 1.12.3 e inferiores. Para explotar esta vulnerabilidad no hace falta estar autenticado. The WP ERP plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 1.12.3 due to insufficient input sanitization and output escaping. • https://patchstack.com/database/vulnerability/erp/wordpress-wp-erp-plugin-1-12-3-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2023-28989 – WordPress Happy Addons for Elementor Plugin <= 3.8.2 is vulnerable to Cross Site Request Forgery (CSRF)
https://notcve.org/view.php?id=CVE-2023-28989
29 Mar 2023 — Cross-Site Request Forgery (CSRF) vulnerability in weDevs Happy Addons for Elementor plugin <= 3.8.2 versions. The Happy Addons for Elementor plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.8.2. This is due to missing nonce validation on the handle_optin_optout() function. This makes it possible for unauthenticated attackers to modify optin and optout settings, via a forged request granted they can trick a site administrator into performing an action such... • https://patchstack.com/database/vulnerability/happy-elementor-addons/wordpress-happy-addons-for-elementor-plugin-3-8-2-cross-site-request-forgery-csrf-on-collect-data-popup?_s_id=cve • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 8.5EPSS: 0%CPEs: 1EXPL: 0CVE-2023-26525 – WordPress Dokan Plugin <= 3.7.12 is vulnerable to SQL Injection
https://notcve.org/view.php?id=CVE-2023-26525
02 Mar 2023 — Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in weDevs Dokan – Best WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy.This issue affects Dokan – Best WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy: from n/a through 3.7.12. Neutralización incorrecta de elementos especiales utilizados en una vulnerabilidad de comando SQL ('inyección SQL') en weDevs Dokan – Best WooCommerce Multivendor Marketp... • https://patchstack.com/database/vulnerability/dokan-lite/wordpress-dokan-plugin-3-7-12-authenticated-sql-injection-vulnerability?_s_id=cve • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 1CVE-2022-3915 – Dokan < 3.7.6 - Unauthenticated SQLi
https://notcve.org/view.php?id=CVE-2022-3915
21 Nov 2022 — The Dokan WordPress plugin before 3.7.6 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users El complemento Dokan WordPress anterior a 3.7.6 no sanitiza ni escapa adecuadamente un parámetro antes de usarlo en una declaración SQL, lo que genera una inyección de SQL explotable por usuarios no autenticados. The Dokan plugin for WordPress is vulnerable to SQL Injection via the ‘user_ids’ parameter in versions up to,... • https://wpscan.com/vulnerability/fd416d99-1970-418f-81f5-8438490d4479 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 1CVE-2021-24649 – WP User Frontend < 3.5.29 - Obscure Registration as Admin
https://notcve.org/view.php?id=CVE-2021-24649
31 Oct 2022 — The WP User Frontend WordPress plugin before 3.5.29 uses a user supplied argument called urhidden in its registration form, which contains the role for the account to be created with, encrypted via wpuf_encryption(). This could allow an attacker having access to the AUTH_KEY and AUTH_SALT constant (via an arbitrary file access issue for example, or if the blog is using the default keys) to create an account with any role they want, such as admin El complemento de WordPress WP User Frontend anterior a 3.5.29... • https://wpscan.com/vulnerability/9486744e-ab24-44e4-b06e-9e0b4be132e2 • CWE-269: Improper Privilege Management •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 1CVE-2022-3194 – Dokan < 3.6.4 - Vendor Stored Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2022-3194
13 Sep 2022 — The Dokan WordPress plugin before 3.6.4 allows vendors to inject arbitrary javascript in product reviews, which may allow them to run stored XSS attacks against other users like site administrators. El complemento Dokan WordPress anterior a 3.6.4 permite a los proveedores inyectar javascript arbitrario en reseñas de productos, lo que puede permitirles ejecutar ataques de XSS almacenado contra otros usuarios, como administradores de sitios. The Dokan plugin for WordPress is vulnerable to Stored Cross-Site Sc... • https://wpscan.com/vulnerability/85e32913-dc2a-44c9-addd-7abde618e995 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •