CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2024-3287 – SmartCrawl WordPress SEO checker, SEO analyzer, SEO optimizer <= 3.10.2 - Missing Authorization
https://notcve.org/view.php?id=CVE-2024-3287
19 Apr 2024 — The SmartCrawl WordPress SEO checker, SEO analyzer, SEO optimizer plugin for WordPress is vulnerable to unauthorized ld+json description injection due to a missing capability check on the save_settings function in all versions up to, and including, 3.10.2. This makes it possible for unauthenticated attackers to save schema types. El complemento SmartCrawl WordPress SEO checker, SEO analyzer, SEO optimizer para WordPress es vulnerable a la inyección no autorizada de descripciones ld+json debido a una falta d... • https://plugins.trac.wordpress.org/changeset/3073136/smartcrawl-seo/trunk/includes/core/schema/class-types.php?old=2943058&old_path=smartcrawl-seo%2Ftrunk%2Fincludes%2Fcore%2Fschema%2Fclass-types.php • CWE-862: Missing Authorization •
CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 0CVE-2024-3053 – Forminator – Contact Form, Payment Form & Custom Form Builder <= 1.29.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via forminator_form Shortcode
https://notcve.org/view.php?id=CVE-2024-3053
08 Apr 2024 — The Forminator – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ forminator_form shortcode attribute in versions up to, and including, 1.29.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. El complemento Forminator – Co... • https://plugins.trac.wordpress.org/changeset/3066927/forminator • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.2EPSS: 1%CPEs: 1EXPL: 0CVE-2024-1794 – Forminator <= 1.29.0 - Unauthenticated Stored Cross-Site Scripting via File Upload
https://notcve.org/view.php?id=CVE-2024-1794
29 Mar 2024 — The Forminator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an uploaded file (e.g. 3gpp file) in all versions up to, and including, 1.29.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. El complemento Forminator para WordPress es vulnerable a Cross-Site Scripting Almacenado a través de un archivo cargado (por ejemplo,... • https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3047085%40forminator&old=3028842%40forminator&sfp_email=&sfph_mail= • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.6EPSS: 1%CPEs: 1EXPL: 0CVE-2024-0368 – Hustle <= 7.8.3 - Sensitive Information Exposure via Exposed Hubspot API Keys
https://notcve.org/view.php?id=CVE-2024-0368
12 Mar 2024 — The Hustle – Email Marketing, Lead Generation, Optins, Popups plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.8.3 via hardcoded API Keys. This makes it possible for unauthenticated attackers to extract sensitive data including PII. El complemento Hustle – Email Marketing, Lead Generation, Optins, Popups para WordPress es vulnerable a la exposición de información confidencial en todas las versiones hasta la 7.8.3 incluida a través de claves API cod... • https://developers.hubspot.com/docs/api/webhooks#manage-settings-via-api • CWE-522: Insufficiently Protected Credentials •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2023-51490 – WordPress Defender Security Plugin <= 4.1.0 is vulnerable to Sensitive Data Exposure
https://notcve.org/view.php?id=CVE-2023-51490
27 Dec 2023 — Exposure of Sensitive Information to an Unauthorized Actor vulnerability in WPMU DEV Defender Security – Malware Scanner, Login Security & Firewall.This issue affects Defender Security – Malware Scanner, Login Security & Firewall: from n/a through 4.1.0. Exposición de información confidencial a una vulnerabilidad de actor no autorizado en WPMU DEV Defender Security: análisis de malware, seguridad de inicio de sesión y firewall. Este problema afecta a Defender Security: análisis de malware, seguridad de inic... • https://patchstack.com/database/vulnerability/defender-security/wordpress-defender-security-plugin-4-1-0-sensitive-data-exposure-via-log-file-vulnerability?_s_id=cve • CWE-532: Insertion of Sensitive Information into Log File •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 1CVE-2023-5949 – SmartCrawl WordPress SEO checker < 3.8.3 - Unauthenticated Password Protected Post Disclosure
https://notcve.org/view.php?id=CVE-2023-5949
23 Nov 2023 — The SmartCrawl WordPress plugin before 3.8.3 does not prevent unauthorised users from accessing password-protected posts' content. El complemento SmartCrawl de WordPress anterior a 3.8.3 no impide que usuarios no autorizados accedan al contenido de las publicaciones protegidas con contraseña. The Simple Social Media Share Buttons plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.8.2 via meta tags. This makes it possible for unauthenticated attackers... • https://wpscan.com/vulnerability/3cec27ca-f470-402d-ae3e-271cb59cf407 • CWE-862: Missing Authorization •
CVSS: 5.3EPSS: 82%CPEs: 1EXPL: 3CVE-2023-5089 – Defender Security < 4.1.0 - Protection Bypass (Hidden Login Page)
https://notcve.org/view.php?id=CVE-2023-5089
06 Sep 2023 — The Defender Security WordPress plugin before 4.1.0 does not prevent redirects to the login page via the auth_redirect WordPress function, allowing an unauthenticated visitor to access the login page, even when the hide login page functionality of the plugin is enabled. El complemento Defender Security para WordPress anterior a 4.1.0 no impide las redirecciones a la página de inicio de sesión a través de la función auth_redirect de WordPress, lo que permite que un visitante no autenticado acceda a la página... • https://github.com/Cappricio-Securities/CVE-2023-5089 • CWE-693: Protection Mechanism Failure •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2022-1009 – Smush < 3.9.9 - Admin+ Reflected Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2022-1009
03 May 2022 — The Smush WordPress plugin before 3.9.9 does not sanitise and escape a configuration parameter before outputting it back in an admin page when uploading a malicious preset configuration, leading to a Reflected Cross-Site Scripting. For the attack to be successful, an attacker would need an admin to upload a malicious configuration file El plugin Smush de WordPress versiones anteriores a 3.9.9, no sanea y escapa de un parámetro de configuración antes de devolverlo a una página de administración cuando es car... • https://wpscan.com/vulnerability/bb5af08f-bb19-46a1-a7ac-8381f428c11e • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.0EPSS: 0%CPEs: 1EXPL: 8CVE-2021-4425 – Defender Security <= 2.4.6 - Cross-Site Request Forgery Bypass
https://notcve.org/view.php?id=CVE-2021-4425
01 Mar 2021 — The Defender Security plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.4.6. This is due to missing or incorrect nonce validation on the verify_otp_login_time() function. This makes it possible for unauthenticated attackers to verify a one time login via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. • https://blog.nintechnet.com/25-wordpress-plugins-vulnerable-to-csrf-attacks • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2017-18510 – Custom Sidebars <= 3.0.9 - Cross-Site Request Forgery
https://notcve.org/view.php?id=CVE-2017-18510
04 Oct 2017 — The custom-sidebars plugin before 3.1.0 for WordPress has CSRF related to set location, import actions, and export actions. El plugin custom-sidebars versiones anteriores a 3.1.0 para WordPress, presenta una vulnerabilidad de tipo CSRF relacionada con ubicación establecida, acciones de importación y acciones de exportación. • https://wordpress.org/plugins/custom-sidebars/#developers • CWE-352: Cross-Site Request Forgery (CSRF) •