CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 1CVE-2024-5071 – Bookster <= 1.1.0 - Unauthenticated Appointment Status Update
https://notcve.org/view.php?id=CVE-2024-5071
The Bookster WordPress plugin through 1.1.0 allows adding sensitive parameters when validating appointments allowing attackers to manipulate the data sent when booking an appointment (the request body) to change its status from pending to approved. El complemento Bookster WordPress hasta la versión 1.1.0 permite agregar parámetros confidenciales al validar citas, lo que permite a los atacantes manipular los datos enviados al reservar una cita (el cuerpo de la solicitud) para cambiar su estado de pendiente a aprobado. The Bookster – WordPress Appointment Booking Plugin plugin for WordPress is vulnerable to unauthorized data manipulation in all versions up to, and including, 1.1.0. This is due to the plugin not properly validating the book_status parameter. This makes it possible for unauthenticated attackers to update their booking status to approved. • https://wpscan.com/vulnerability/07b293cf-5174-45de-8606-a782a96a35b3 • CWE-639: Authorization Bypass Through User-Controlled Key CWE-863: Incorrect Authorization •
CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 1CVE-2024-5199 – Spotify Play Button <= 1.0 - Contributor+ Stored XSS
https://notcve.org/view.php?id=CVE-2024-5199
The Spotify Play Button WordPress plugin through 1.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. El complemento Spotify Play Button de WordPress hasta la versión 1.0 no valida ni escapa algunos de sus atributos de código corto antes de devolverlos a una página/publicación donde está incrustado el código corto, lo que podría permitir a los usuarios con el rol de colaborador y superior realizar ataques de Cross-Site Scripting Almacenado. The Spotify Play Button plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's spotify-play shortcode in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. • https://wpscan.com/vulnerability/a2cb8d7d-6d7c-42e9-b3db-cb3959bfd41b • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.1EPSS: 0%CPEs: 1EXPL: 1CVE-2024-4757 – Logo Manager For Enamad <= 0.7.0 - Stored XSS via CSRF
https://notcve.org/view.php?id=CVE-2024-4757
The Logo Manager For Enamad WordPress plugin through 0.7.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack El complemento Logo Manager For Enamad WordPress hasta la versión 0.7.0 no tiene verificación CSRF en algunos lugares y le falta sanitización y escape, lo que podría permitir a los atacantes hacer que el administrador que haya iniciado sesión agregue payloads XSS almacenados a través de un ataque CSRF. The Logo Manager For Enamad plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.7.0. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to update plugin settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. • https://wpscan.com/vulnerability/b54b55e0-b184-4c90-ba94-feda0997bf2a • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 7.2EPSS: 0%CPEs: 1EXPL: 1CVE-2024-4759 – Mime Types Extended <= 0.11 - Author+ Stored XSS via SVG Upload
https://notcve.org/view.php?id=CVE-2024-4759
The Mime Types Extended WordPress plugin through 0.11 does not sanitise uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads. El complemento Mime Types Extended WordPress hasta la versión 0.11 no sanitiza los archivos SVG cargados, lo que podría permitir a los usuarios con un rol tan bajo como Autor cargar un SVG malicioso que contenga payloads XSS. The Mime Types Extended plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in version 0.11 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file. • https://wpscan.com/vulnerability/1c7547fa-539a-4890-a94d-c57b3d025507 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 1CVE-2024-4900 – SEOPress < 7.8 - Contributor+ Open Redirect
https://notcve.org/view.php?id=CVE-2024-4900
The SEOPress WordPress plugin before 7.8 does not validate and escape one of its Post settings, which could allow contributor and above role to perform Open redirect attacks against any user viewing a malicious post El complemento SEOPress WordPress anterior a 7.8 no valida ni escapa a una de sus configuraciones de publicación, lo que podría permitir que el colaborador y el rol superior realicen ataques de redireccionamiento abierto contra cualquier usuario que vea una publicación maliciosa. The SEOPress – On-site SEO plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 7.7.2. This is due to insufficient validation on the social post settings. This makes it possible for an authenticated attacker, with contributor-level access and above, to redirect users to potentially malicious sites if they can successfully trick them into performing an action. • https://wpscan.com/vulnerability/a56ad272-e2ed-4064-9b5d-114a834dd8b3 • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •