CVSS: 7.2EPSS: 0%CPEs: 1EXPL: 1CVE-2023-0038 – Survey Maker – Best WordPress Survey Plugin <= 3.1.3 - Unauthenticated Stored Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2023-0038
03 Jan 2023 — The "Survey Maker – Best WordPress Survey Plugin" plugin for WordPress is vulnerable to Stored Cross-Site Scripting via survey answers in versions up to, and including, 3.1.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts when submitting quizzes that will execute whenever a user accesses the submissions page. • https://plugins.trac.wordpress.org/browser/survey-maker/tags/3.1.4/public/partials/class-survey-maker-submissions-summary-shortcode.php?rev=2839688#L311 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 1CVE-2022-1456 – Poll Maker < 4.0.2 - Admin+ Stored Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2022-1456
04 May 2022 — The Poll Maker WordPress plugin before 4.0.2 does not sanitise and escape some settings, which could allow high privilege users such as admin to perform Store Cross-Site Scripting attack even when unfiltered_html is disallowed El plugin Poll Maker de WordPress versiones anteriores a 4.0.2, no sanea y escapa de algunos parámetros, lo que podría permitir a usuarios con altos privilegios, como los administradores, llevar a cabo un ataque de tipo Cross-Site Scripting Almacenado incluso cuando unfiltered_html es... • https://wpscan.com/vulnerability/1f41fc5c-18d0-493d-9a7d-8b521ab49f85 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 70%CPEs: 1EXPL: 1CVE-2022-1013 – Personal Dictionary < 1.3.4 - Unauthenticated SQLi
https://notcve.org/view.php?id=CVE-2022-1013
18 Apr 2022 — The Personal Dictionary WordPress plugin before 1.3.4 fails to properly sanitize user supplied POST data before it is being interpolated in an SQL statement and then executed, leading to a blind SQL injection vulnerability. El plugin Personal Dictionary de WordPress versiones hasta 1.3.4, no sanea apropiadamente los datos POST suministrados por el usuario antes de que sean interpolados en una sentencia SQL y sean ejecutados, conllevando a una vulnerabilidad de inyección SQL ciega • https://wpscan.com/vulnerability/eed70659-9e3e-42a2-b427-56c52e0fbc0d • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2022-0641 – Popup Like box < 3.6.1 - Reflected Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2022-0641
07 Mar 2022 — The Popup Like box WordPress plugin before 3.6.1 does not sanitize and escape the ays_fb_tab parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting. El plugin Popup Like box de WordPress versiones anteriores a 3.6.1, no sanea y escapa del parámetro ays_fb_tab antes de devolverlo en una página de administración, conllevando a un problema de tipo Cross-Site Scripting Reflejado • https://wpscan.com/vulnerability/0a9830df-5f5d-40a3-9841-40994275136f • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.2EPSS: 1%CPEs: 1EXPL: 1CVE-2021-26256 – WordPress Survey Maker plugin <= 2.0.6 - Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability
https://notcve.org/view.php?id=CVE-2021-26256
03 Dec 2021 — Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability discovered in Survey Maker WordPress plugin (versions <= 2.0.6). Se ha detectado una vulnerabilidad de tipo Cross-Site Scripting (XSS) no autenticada en el plugin Survey Maker de WordPress (versiones anteriores a 2.0.6 incluyéndola) • https://patchstack.com/database/vulnerability/survey-maker/wordpress-survey-maker-plugin-2-0-6-unauthenticated-stored-cross-site-scripting-xss-vulnerability • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 69%CPEs: 1EXPL: 5CVE-2021-24931 – Secure Copy Content Protection and Content Locking < 2.8.2 - Unauthenticated SQL Injection
https://notcve.org/view.php?id=CVE-2021-24931
08 Nov 2021 — The Secure Copy Content Protection and Content Locking WordPress plugin before 2.8.2 does not escape the sccp_id parameter of the ays_sccp_results_export_file AJAX action (available to both unauthenticated and authenticated users) before using it in a SQL statement, leading to an SQL injection. El plugin Secure Copy Content Protection and Content Locking de WordPress versiones anteriores a 2.8.2, no escapa del parámetro sccp_id de la acción AJAX ays_sccp_results_export_file (disponible para usuarios autenti... • https://packetstorm.news/files/id/181133 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 7.5EPSS: 1%CPEs: 1EXPL: 1CVE-2021-24651 – Poll Maker < 3.4.2 - Unauthenticated Time Based SQL Injection
https://notcve.org/view.php?id=CVE-2021-24651
13 Sep 2021 — The Poll Maker WordPress plugin before 3.4.2 allows unauthenticated users to perform SQL injection via the ays_finish_poll AJAX action. While the result is not disclosed in the response, it is possible to use a timing attack to exfiltrate data such as password hash. El plugin Poll Maker de WordPress versiones anteriores a 3.4.2, permite a usuarios no autenticados llevar a cabo una inyección SQL por medio de la acción ays_finish_poll AJAX. Mientras que el resultado no se revela en la respuesta, es posible us... • https://wpscan.com/vulnerability/24f933b0-ad57-4ed3-817d-d637256e2fb1 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') CWE-203: Observable Discrepancy •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2021-34635 – Poll Maker <= 3.2.8 - Reflected Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2021-34635
26 Jul 2021 — The Poll Maker WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the mcount parameter found in the ~/admin/partials/settings/poll-maker-settings.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 3.2.8. El plugin Poll Maker WordPress es vulnerable a un ataque de tipo Cross-Site Scripting Reflejado por medio del parámetro mcount encontrado en el archivo ~/admin/partials/settings/poll-maker-settings.php que permite a atacantes inyectar scripts w... • https://plugins.trac.wordpress.org/browser/poll-maker/tags/3.2.8/admin/partials/settings/poll-maker-settings.php#L249 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.2EPSS: 0%CPEs: 1EXPL: 0CVE-2021-24456 – Quiz Maker < 6.2.0.9 - Multiple Authenticated Blind SQL Injections
https://notcve.org/view.php?id=CVE-2021-24456
29 Jun 2021 — The Quiz Maker WordPress plugin before 6.2.0.9 did not properly sanitise and escape the order and orderby parameters before using them in SQL statements, leading to SQL injection issues in the admin dashboard El plugin Quiz Maker WordPress versiones anteriores a 6.2.0.9, no saneaba y escapaba correctamente los parámetros order y orderby antes de usarlos en sentencias SQL, conllevando a problemas de inyección SQL en el panel de administración • https://wpscan.com/vulnerability/929ad37d-9cdb-4117-8cd3-cf7130a7c9d4 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 1CVE-2021-24457 – Portfolio Responsive Gallery < 1.1.8 - Authenticated Blind SQL Injections
https://notcve.org/view.php?id=CVE-2021-24457
29 Jun 2021 — The get_portfolios() and get_portfolio_attributes() functions in the class-portfolio-responsive-gallery-list-table.php and class-portfolio-responsive-gallery-attributes-list-table.php files of the Portfolio Responsive Gallery WordPress plugin before 1.1.8 did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the get_results() DB calls, leading to SQL injection issues in the admin dashboard Las funciones get_portfolios() y get_portfolio_attributes() de los archiv... • https://wpscan.com/vulnerability/97f4f7da-22a8-42a6-88ac-82e95a6c06dd • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •