CVSS: 4.8EPSS: 0%CPEs: 1EXPL: 1CVE-2021-24702 – LearnPress < 4.1.3.1 - Multiple Admin+ Stored Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2021-24702
The LearnPress WordPress plugin before 4.1.3.1 does not properly sanitize or escape various inputs within course settings, which could allow high privilege users to perform Cross-Site Scripting attacks when the unfiltred_html capability is disallowed El plugin LearnPress de WordPress versiones anteriores a 4.1.3.1, no sanea o escapa apropiadamente de varias entradas dentro de la configuración del curso, que podría permitir a usuarios con altos privilegios llevar a cabo ataques de tipo Cross-Site Scripting cuando la capacidad unfiltred_html no está permitida • https://wpscan.com/vulnerability/30635cc9-4415-48bb-9c67-ea670ea1b942 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 1%CPEs: 1EXPL: 1CVE-2020-29047 – WP Hotel Booking <= 1.10.3 - Remote Code Execution
https://notcve.org/view.php?id=CVE-2020-29047
The wp-hotel-booking plugin through 1.10.2 for WordPress allows remote attackers to execute arbitrary code because of an unserialize operation on the thimpress_hotel_booking_1 cookie in load in includes/class-wphb-sessions.php. El plugin wp-hotel-booking versiones hasta 1.10.2 para WordPress, permite a atacantes remotos ejecutar código arbitrario debido a una operación de deserializar en la cookie thimpress_hotel_booking_1 en la carga en el archivo includes/classwphb-sessions.php The wp-hotel-booking plugin through 1.10.3 for WordPress allows remote attackers to execute arbitrary code because of an unserialize operation on the thimpress_hotel_booking_1 cookie in load in includes/class-wphb-sessions.php. This was finally patched in 1.10.04 • https://appcheck-ng.com/cve-2020-29047 https://wordpress.org/plugins/wp-hotel-booking/#developers • CWE-502: Deserialization of Untrusted Data •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2020-36757 – WP Hotel Booking <= 1.10.1 - Cross-Site Request Forgery Bypass
https://notcve.org/view.php?id=CVE-2020-36757
The WP Hotel Booking plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.10.1. This is due to missing or incorrect nonce validation on the admin_add_order_item() function. This makes it possible for unauthenticated attackers to add an order item via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. • https://blog.nintechnet.com/25-wordpress-plugins-vulnerable-to-csrf-attacks https://blog.nintechnet.com/more-wordpress-plugins-and-themes-vulnerable-to-csrf-attacks https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-1 https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-2 https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-3 https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-4 https://blo • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 8.8EPSS: 11%CPEs: 1EXPL: 2CVE-2020-6010 – LearnPress <= 3.2.6.7 - SQL Injection
https://notcve.org/view.php?id=CVE-2020-6010
LearnPress Wordpress plugin version prior and including 3.2.6.7 is vulnerable to SQL Injection El plugin LearnPress Wordpress versiones anteriores e incluyendo a 3.2.6.7, es vulnerable a una Inyección SQL. LearnPress, a learning management plugin for WordPress, prior to 3.2.6.8 is affected by an authenticated SQL injection via the current_items parameter of the post-new.php page. • https://www.exploit-db.com/exploits/50137 http://packetstormsecurity.com/files/163536/WordPress-LearnPress-SQL-Injection.html https://plugins.trac.wordpress.org/browser/learnpress/trunk/readme.txt?rev=2288975 https://research.checkpoint.com/2020/e-learning-platforms-getting-schooled-multiple-vulnerabilities-in-wordpress-most-popular-learning-management-system-plugins https://wordpress.org/plugins/learnpress/#developers • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 8.1EPSS: 8%CPEs: 1EXPL: 2CVE-2020-11511 – LearnPress <= 3.2.6.8 - Privilege Escalation via accept-to-be-teacher action parameter
https://notcve.org/view.php?id=CVE-2020-11511
The LearnPress plugin before 3.2.6.9 for WordPress allows remote attackers to escalate the privileges of any user to LP Instructor via the accept-to-be-teacher action parameter. El plugin LearnPress versiones anteriores a 3.2.6.9 para WordPress, permite a atacantes remotos escalar privilegios de cualquier usuario a Instructor LP por medio del parámetro accept-to-be-teacher action WordPress LearnPress plugin versions prior to 3.2.6.9 suffer from a privilege escalation vulnerability. • http://packetstormsecurity.com/files/163538/WordPress-LearnPress-Privilege-Escalation.html https://cwe.mitre.org/data/definitions/862.html https://wordpress.org/plugins/learnpress/#developers https://www.wordfence.com/blog/2020/04/high-severity-vulnerabilities-patched-in-learnpress • CWE-269: Improper Privilege Management CWE-862: Missing Authorization •