CVSS: 5.9EPSS: 0%CPEs: 1EXPL: 0CVE-2023-23870 – WordPress Responsive Vertical Icon Menu Plugin <= 1.5.8 is vulnerable to Cross Site Scripting (XSS)
https://notcve.org/view.php?id=CVE-2023-23870
20 Jan 2023 — Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in wpdevart Responsive Vertical Icon Menu plugin <= 1.5.8 versions. The Responsive Vertical Icon Menu plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 1.5.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrative-level permissions and above, to inject arbitrary web scripts in pages that will execute wh... • https://patchstack.com/database/vulnerability/wpdevart-vertical-menu/wordpress-responsive-vertical-icon-menu-plugin-1-5-8-cross-site-scripting-xss?_s_id=cve • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 0CVE-2023-23983 – WordPress Responsive Vertical Icon Menu Plugin <= 1.5.8 is vulnerable to Cross Site Request Forgery (CSRF)
https://notcve.org/view.php?id=CVE-2023-23983
20 Jan 2023 — Cross-Site Request Forgery (CSRF) vulnerability in wpdevart Responsive Vertical Icon Menu plugin <= 1.5.8 can lead to theme deletion. The Responsive Vertical Icon Menu plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.5.8. This is due to missing or incorrect nonce validation on several functions related to the plugin's theme manipulation. This makes it possible for unauthenticated attackers to invoke these functions, via forged request granted they can tric... • https://patchstack.com/database/vulnerability/wpdevart-vertical-menu/wordpress-responsive-vertical-icon-menu-plugin-1-5-8-cross-site-request-forgery-csrf-leading-to-settings-change-vulnerability?_s_id=cve • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 10.0EPSS: 90%CPEs: 1EXPL: 1CVE-2022-3982 – Booking Calendar < 3.2.2 - Unauthenticated Arbitrary File Upload
https://notcve.org/view.php?id=CVE-2022-3982
21 Nov 2022 — The Booking calendar, Appointment Booking System WordPress plugin before 3.2.2 does not validate uploaded files, which could allow unauthenticated users to upload arbitrary files, such as PHP and achieve RCE El complemento Booking calendar, Appointment Booking System para WordPress anterior a 3.2.2 no valida los archivos cargados, lo que podría permitir a usuarios no autenticados cargar archivos arbitrarios, como PHP y lograr RCE. The Booking calendar, Appointment Booking System plugin for WordPress is vuln... • https://wpscan.com/vulnerability/4d91f3e1-4de9-46c1-b5ba-cc55b7726867 • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 0CVE-2022-34656 – WordPress Poll, Survey, Questionnaire and Voting system plugin <= 1.7.4 - Authenticated Cross-Site Scripting (XSS) vulnerability
https://notcve.org/view.php?id=CVE-2022-34656
25 Aug 2022 — Authenticated (admin+) Cross-Site Scripting (XSS) vulnerability in wpdevart Poll, Survey, Questionnaire and Voting system plugin <= 1.7.4 at WordPress. Una vulnerabilidad de tipo Cross-Site Scripting (XSS) Autenticado (admin+) en el plugin wpdevart Poll, Survey, Questionnaire and Voting system versiones anteriores a 1.7.4 incluyéndola en WordPress. The Poll, Survey, Questionnaire and Voting system plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.7.4 due t... • https://patchstack.com/database/vulnerability/polls-widget/wordpress-poll-survey-questionnaire-and-voting-system-plugin-1-7-4-authenticated-cross-site-scripting-xss-vulnerability/_s_id=cve • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2022-1946 – Gallery < 2.0.0 - Reflected Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2022-1946
13 Jun 2022 — The Gallery WordPress plugin before 2.0.0 does not sanitise and escape a parameter before outputting it back in the response of an AJAX action (available to both unauthenticated and authenticated users), leading to a Reflected Cross-Site Scripting issue El plugin Gallery de WordPress versiones anteriores a 2.0.0, no sanea y escapa de un parámetro antes de devolverlo en la respuesta de una acción AJAX (disponible tanto para usuarios no autentificados como autentificados), conlleva un problema de tipo Cross-S... • https://wpscan.com/vulnerability/0903920c-be2e-4515-901f-87253eb30940 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 1CVE-2022-0876 – Social comments by WpDevArt < 2.5.0 - Admin+ Stored Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2022-0876
09 Apr 2022 — The Social comments by WpDevArt WordPress plugin before 2.5.0 does not sanitise and escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when unfiltered_html is disallowed El plugin Social comments by WpDevArt de WordPress versiones anteriores a 2.5.0 no sanea ni escapa de su configuración, permitiendo a usuarios con privilegios elevados, como los administradores, llevar a cabo ataques de tipo cross-Site Scripting incluso cuando unfiltered_html no est... • https://wpscan.com/vulnerability/73be6e92-ea37-4416-977d-52ee2afa022a • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2022-0640 – AP Pricing Tables Lite < 1.1.5 - Reflected Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2022-0640
28 Feb 2022 — The Pricing Table Builder WordPress plugin before 1.1.5 does not sanitize and escape the postid parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting. El plugin Pricing Table Builder de WordPress versiones anteriores a 1.1.5, no sanea y escapa del parámetro postid antes de devolverlo a una página de administración, conllevando a un problema de tipo Cross-Site Scripting Reflejado • https://plugins.trac.wordpress.org/changeset/2684253 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 1CVE-2022-0164 – Coming soon and Maintenance mode < 3.6.7 - Subscriber+ Arbitrary Email Sending to Subscribed Users
https://notcve.org/view.php?id=CVE-2022-0164
24 Jan 2022 — The Coming soon and Maintenance mode WordPress plugin before 3.5.3 does not have authorisation and CSRF checks in its coming_soon_send_mail AJAX action, allowing any authenticated users, with a role as low as subscriber to send arbitrary emails to all subscribed users El plugin Coming soon y Maintenance mode de WordPress versiones anteriores a 3.6.8, no presenta comprobaciones de autorización y CSRF en su acción coming_soon_send_mail AJAX, permitiendo a cualquier usuario autenticado, con un rol tan bajo com... • https://plugins.trac.wordpress.org/changeset/2655973 • CWE-352: Cross-Site Request Forgery (CSRF) CWE-862: Missing Authorization CWE-863: Incorrect Authorization •
CVSS: 6.4EPSS: 9%CPEs: 1EXPL: 1CVE-2021-25075 – Duplicate Page or Post < 1.5.1 - Arbitrary Settings Update to Stored XSS
https://notcve.org/view.php?id=CVE-2021-25075
24 Jan 2022 — The Duplicate Page or Post WordPress plugin before 1.5.1 does not have any authorisation and has a flawed CSRF check in the wpdevart_duplicate_post_parametrs_save_in_db AJAX action, allowing any authenticated users, such as subscriber to call it and change the plugin's settings, or perform such attack via CSRF. Furthermore, due to the lack of escaping, this could lead to Stored Cross-Site Scripting issues El plugin Duplicate Page or Post de WordPress versiones anteriores a 1.5.1, no presenta ninguna autoriz... • https://wpscan.com/vulnerability/db5a0431-af4d-45b7-be4e-36b6c90a601b • CWE-862: Missing Authorization •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 1CVE-2022-0199 – Coming soon and Maintenance mode < 3.6.8 - Arbitrary Email Sending to Subscribed Users via CSRF
https://notcve.org/view.php?id=CVE-2022-0199
23 Jan 2022 — The Coming soon and Maintenance mode WordPress plugin before 3.6.8 does not have CSRF check in its coming_soon_send_mail AJAX action, allowing attackers to make logged in admin to send arbitrary emails to all subscribed users via a CSRF attack El plugin Coming soon y Maintenance mode de WordPress versiones anteriores a 3.6.8, no presenta comprobación CSRF en su acción coming_soon_send_mail AJAX, permitiendo a atacantes hacer que el administrador conectado envíe correos electrónicos arbitrarios a todos los u... • https://plugins.trac.wordpress.org/changeset/2659455 • CWE-352: Cross-Site Request Forgery (CSRF) •