CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 1CVE-2024-4900 – SEOPress < 7.8 - Contributor+ Open Redirect
https://notcve.org/view.php?id=CVE-2024-4900
The SEOPress WordPress plugin before 7.8 does not validate and escape one of its Post settings, which could allow contributor and above role to perform Open redirect attacks against any user viewing a malicious post El complemento SEOPress WordPress anterior a 7.8 no valida ni escapa a una de sus configuraciones de publicación, lo que podría permitir que el colaborador y el rol superior realicen ataques de redireccionamiento abierto contra cualquier usuario que vea una publicación maliciosa. The SEOPress – On-site SEO plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 7.7.2. This is due to insufficient validation on the social post settings. This makes it possible for an authenticated attacker, with contributor-level access and above, to redirect users to potentially malicious sites if they can successfully trick them into performing an action. • https://wpscan.com/vulnerability/a56ad272-e2ed-4064-9b5d-114a834dd8b3 • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •
CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 1CVE-2024-4899 – SEOPress < 7.8 - Contributor+ Stored XSS
https://notcve.org/view.php?id=CVE-2024-4899
The SEOPress WordPress plugin before 7.8 does not sanitise and escape some of its Post settings, which could allow high privilege users such as contributor to perform Stored Cross-Site Scripting attacks. El complemento SEOPress WordPress anterior a 7.8 no sanitiza ni escapa a algunas de sus configuraciones de publicación, lo que podría permitir a usuarios con altos privilegios, como los contribuyentes, realizar ataques de Cross-Site Scripting Almacenado. The SEOPress – On-site SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the SEO Title field parameter in all versions up to, and including, 7.7.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. • https://wpscan.com/vulnerability/15346ae9-9a29-4968-a6a9-81d1116ac448 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 1CVE-2024-5475 – Responsive video embed < 0.5.1 - Contributor+ Stored XSS
https://notcve.org/view.php?id=CVE-2024-5475
The Responsive video embed WordPress plugin before 0.5.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. El complemento Responsive video embed de WordPress anterior a 0.5.1 no valida ni escapa algunos de sus atributos de código corto antes de devolverlos a una página/publicación donde se incrusta el código corto, lo que podría permitir a los usuarios con el rol de colaborador y superior realizar ataques de Cross-Site Scripting Almacenado. The Responsive video embed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's embed shortcode in all versions up to, and including, 0.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. • https://wpscan.com/vulnerability/cee66543-b5d6-4205-8f9b-0febd7fee445 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 4CVE-2024-5522 – HTML5 Video Player < 2.5.27 - Unauthenticated SQLi
https://notcve.org/view.php?id=CVE-2024-5522
The HTML5 Video Player WordPress plugin before 2.5.27 does not sanitize and escape a parameter from a REST route before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks El complemento HTML5 Video Player de WordPress anterior a 2.5.27 no sanitiza ni escapa un parámetro de una ruta REST antes de usarlo en una declaración SQL, lo que permite a usuarios no autenticados realizar ataques de inyección SQL. The HTML5 Video Player – Best WordPress Video Player Plugin and Block plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 2.5.26 due to insufficient escaping on a user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. • https://github.com/truonghuuphuc/CVE-2024-5522-Poc https://github.com/kryptonproject/CVE-2024-5522-PoC https://github.com/geniuszlyy/CVE-2024-5522 https://wpscan.com/vulnerability/bc76ef95-a2a9-4185-8ed9-1059097a506a • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 1CVE-2024-4565 – Advanced Custom Fields < 6.3 - Contributor+ Custom Field Access
https://notcve.org/view.php?id=CVE-2024-4565
The Advanced Custom Fields (ACF) WordPress plugin before 6.3, Advanced Custom Fields Pro WordPress plugin before 6.3 allows you to display custom field values for any post via shortcode without checking for the correct access El complemento Advanced Custom Fields (ACF) WordPress anterior a 6.3, el complemento de Advanced Custom Fields Pro WordPress anterior a 6.3 le permite mostrar valores de campo personalizados para cualquier publicación mediante un código corto sin verificar el acceso correcto The Advanced Custom Fields (ACF) plugin for WordPress is vulnerable to arbitrary custom field access in all versions up to, and including, 6.2.10. This is due to the plugin not properly restricting what post meta can be displayed through the plugin's shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to retrieve potentially sensitive information from custom fields. • https://wpscan.com/vulnerability/430224c4-d6e3-4ca8-b1bc-b2229a9bcf12 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •