CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 1CVE-2024-2441 – VikBooking < 1.6.8 - Insecure Direct Object References
https://notcve.org/view.php?id=CVE-2024-2441
The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.6.8 allows direct access to menus, allowing an authenticated user with subscriber privileges or above, to bypass authorization and access settings of the VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.6.8's they shouldn't be allowed to. El complemento VikBooking Hotel Booking Engine & PMS WordPress anterior a 1.6.8 permite el acceso directo a los menús, lo que permite a un usuario autenticado con privilegios de suscriptor o superiores omitir la autorización y acceder a la configuración del complemento VikBooking Hotel Booking Engine & PMS WordPress anterior a 1.6.8. no debería permitírselo. The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.6.7 via the option endpoint due to missing validation on the 'task' user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to view menus they shouldn't have access to. • https://wpscan.com/vulnerability/9647e273-5724-4a02-868d-9b79f4bb2b79 • CWE-639: Authorization Bypass Through User-Controlled Key •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 1CVE-2024-3940 – reCAPTCHA Jetpack <= 0.2.2 - Settings Update via CSRF
https://notcve.org/view.php?id=CVE-2024-3940
The reCAPTCHA Jetpack WordPress plugin through 0.2.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack El complemento reCAPTCHA Jetpack WordPress hasta la versión 0.2.2 no tiene activada la verificación CSRF al actualizar su configuración, lo que podría permitir a los atacantes hacer que un administrador que haya iniciado sesión los cambie mediante un ataque CSRF. The reCAPTCHA Jetpack plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.2.2. This is due to missing or incorrect nonce validation on the recaptcha-jetpack page. This makes it possible for unauthenticated attackers to update settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. • https://wpscan.com/vulnerability/bb0245e5-8e94-4f11-9003-d6208945056c • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 4.8EPSS: 0%CPEs: 1EXPL: 1CVE-2023-5971 – Save as PDF < 3.2.0 - Admin+ Stored XSS
https://notcve.org/view.php?id=CVE-2023-5971
The Save as PDF Plugin by Pdfcrowd WordPress plugin before 3.2.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) El complemento Save as PDF Plugin by Pdfcrowd para WordPress anterior a 3.2.0 no sanitiza ni escapa a algunas de sus configuraciones, lo que podría permitir a usuarios con altos privilegios, como el administrador, realizar ataques de Cross-Site Scripting Almacenado incluso cuando la capacidad unfiltered_html no está permitida (por ejemplo en configuración multisitio) The Save as PDF Plugin by Pdfcrowd plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. • https://wpscan.com/vulnerability/03a201d2-535e-4574-afac-791dcf23e6e1 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2024-3582 – Ungallery <= 2.2.4 - Stored XSS via CSRF
https://notcve.org/view.php?id=CVE-2024-3582
The UnGallery WordPress plugin through 2.2.4 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack El complemento UnGallery WordPress hasta la versión 2.2.4 no tiene verificación CSRF en algunos lugares y le falta sanitización y escape, lo que podría permitir a los atacantes hacer que el administrador registrado agregue payloads XSS almacenado a través de un ataque CSRF. The UnGallery plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.2.4. This is due to missing or incorrect nonce validation on the ungallerysettings page. This makes it possible for unauthenticated attackers to modify plugin settings and inject malicious webscripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. • https://wpscan.com/vulnerability/5a348b5d-13aa-40c3-9d21-0554683f8019 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2024-3590 – LetterPress <= 1.2.2 - Subscriber Deletion via CSRF
https://notcve.org/view.php?id=CVE-2024-3590
The LetterPress WordPress plugin through 1.2.2 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks, such as delete arbitrary subscribers El complemento LetterPress WordPress hasta la versión 1.2.2 no tiene comprobaciones CSRF en algunos lugares, lo que podría permitir a los atacantes hacer que los usuarios que han iniciado sesión realicen acciones no deseadas a través de ataques CSRF, como eliminar suscriptores arbitrarios. The LetterPress – Elevate Your WordPress Site's E-Mail Campaigns and Marketing plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.2. This is due to missing or incorrect nonce validation on the letterpress-subscribers page. This makes it possible for unauthenticated attackers to delete subscribers via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. • https://wpscan.com/vulnerability/829f4d40-e5b0-4009-b753-85ca2a5b3d25 • CWE-352: Cross-Site Request Forgery (CSRF) •