CVSS: 7.1EPSS: 0%CPEs: 1EXPL: 0CVE-2022-47140 – WordPress ARMember Plugin <= 4.0.1 is vulnerable to Cross Site Scripting (XSS)
https://notcve.org/view.php?id=CVE-2022-47140
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Repute InfoSystems ARMember plugin <= 4.0.1 versions. The ARMember plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'redirect_to' parameter in versions up to, and including, 4.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. • https://patchstack.com/database/vulnerability/armember-membership/wordpress-armember-plugin-4-0-cross-site-scripting-xss?_s_id=cve • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2022-46808 – WordPress ARMember Plugin <= 3.4.11 is vulnerable to SQL Injection
https://notcve.org/view.php?id=CVE-2022-46808
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Repute Infosystems ARMember armember-membership allows SQL Injection.This issue affects ARMember: from n/a through 3.4.11. Neutralización inadecuada de elementos especiales utilizados en una vulnerabilidad de comando SQL ('Inyección SQL') en Repute Infosystems ARMember armember-membership permite la inyección SQL. Este problema afecta a ARMember: desde n/a hasta 3.4.11. The ARMember plugin for WordPress is vulnerable to SQL Injection via an unknown parameter in versions up to, and including, 3.4.11 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. • https://patchstack.com/database/vulnerability/armember-membership/wordpress-armember-3-4-11-sql-injection?_s_id=cve • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 1CVE-2022-4340 – BookingPress < 1.0.31 - Unauthenticated IDOR in appointment_id
https://notcve.org/view.php?id=CVE-2022-4340
The BookingPress WordPress plugin before 1.0.31 suffers from an Insecure Direct Object Reference (IDOR) vulnerability in it's thank you page, allowing any visitor to display information about any booking, including full name, date, time and service booked, by manipulating the appointment_id query parameter. El complemento BookingPress de WordPress anterior a la versión 1.0.31 sufre una vulnerabilidad de Insecure Direct Object Reference (IDOR) en su página de agradecimiento, lo que permite a cualquier visitante mostrar información sobre cualquier reserva, incluido el nombre completo, la fecha, la hora y el servicio reservado, manipulando el id de cita. parámetro de consulta. The BookingPress plugin for WordPress is vulnerable to insecure direct object reference in versions up to, and including, 1.0.30. This is due to insufficient validation on the 'appointment_id' user-controlled key. This makes it possible for unauthenticated attackers to retrieve booking information that includes booked services along with the name and time of booking. • https://wpscan.com/vulnerability/8a7bd9f6-2789-474b-a237-01c643fdfba7 • CWE-639: Authorization Bypass Through User-Controlled Key •
CVSS: 7.2EPSS: 0%CPEs: 1EXPL: 0CVE-2022-45838 – WordPress ARForms Form Builder Plugin <= 1.5.5 is vulnerable to Cross Site Scripting (XSS)
https://notcve.org/view.php?id=CVE-2022-45838
Unauth. Stored Cross-Site Scripting (XSS) vulnerability in Repute InfoSystems ARForms Form Builder plugin <= 1.5.5 versions. The ARForms Form Builder plugin for WordPress is vulnerable to Cross-Site Scripting via an unspecified parameter in versions up to, and including, 1.5.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. • https://patchstack.com/database/vulnerability/arforms-form-builder/wordpress-arforms-form-builder-plugin-1-5-3-unauth-stored-cross-site-scripting-xss-vulnerability?_s_id=cve • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 9%CPEs: 1EXPL: 1CVE-2022-0867 – ARPrice Lite < 3.6.1 - Unauthenticated SQLi
https://notcve.org/view.php?id=CVE-2022-0867
The Pricing Table WordPress plugin before 3.6.1 fails to properly sanitize and escape user supplied POST data before it is being interpolated in an SQL statement and then executed via an AJAX action available to unauthenticated users El plugin Pricing Table de WordPress versiones anteriores a 3.6.1, no sanea ni escapa de los datos POST suministrados por el usuario antes de que sean interpolados en una sentencia SQL y sean ejecutados por medio de una acción AJAX disponible para usuarios no autenticados • https://wpscan.com/vulnerability/62803aae-9896-410b-9398-3497a838e494 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •