CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2023-28168 – WordPress WordPress Console plugin <= 0.3.9 - Broken Access Control vulnerability
https://notcve.org/view.php?id=CVE-2023-28168
14 Mar 2023 — Missing Authorization vulnerability in Jerod Santo WordPress Console allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WordPress Console: from n/a through 0.3.9. The WordPress Console plugin for WordPress is vulnerable to unauthorized modification of data and execution of files due to missing authorization in several files such as reload.php, complete.php, and query that is also missing direct file access controls in versions up to, and including, 0.3.9. This makes i... • https://patchstack.com/database/wordpress/plugin/wordpress-console/vulnerability/wordpress-wordpress-console-plugin-0-3-9-broken-access-control-vulnerability?_s_id=cve • CWE-862: Missing Authorization •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2023-23887 – WordPress Easy Google Analytics for WordPress plugin <= 1.6.0 - Broken Access Control vulnerability
https://notcve.org/view.php?id=CVE-2023-23887
20 Feb 2023 — Missing Authorization vulnerability in Shaon Easy Google Analytics for WordPress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easy Google Analytics for WordPress: from n/a through 1.6.0. The Easy Google Analytics for WordPress plugin is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.6.0. This is due to missing or incorrect nonce validation in the 'ga_admin_set.php' file. This makes it possible for unauthenticated attackers to update... • https://patchstack.com/database/wordpress/plugin/easy-google-analytics-for-wordpress/vulnerability/wordpress-easy-google-analytics-for-wordpress-plugin-1-6-0-broken-access-control-vulnerability?_s_id=cve • CWE-352: Cross-Site Request Forgery (CSRF) CWE-862: Missing Authorization •
CVSS: 5.9EPSS: 0%CPEs: 1EXPL: 0CVE-2023-23806 – WordPress WordPress Custom Settings Plugin <= 1.0 is vulnerable to Cross Site Scripting (XSS)
https://notcve.org/view.php?id=CVE-2023-23806
20 Feb 2023 — Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Davinder Singh Custom Settings plugin <= 1.0 versions. The WordPress Custom Settings plugin is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injec... • https://patchstack.com/database/vulnerability/custom-settings/wordpress-wordpress-custom-settings-plugin-1-0-cross-site-scripting-xss-vulnerability?_s_id=cve • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.3EPSS: 5%CPEs: 1EXPL: 1CVE-2023-22622
https://notcve.org/view.php?id=CVE-2023-22622
05 Jan 2023 — WordPress through 6.1.1 depends on unpredictable client visits to cause wp-cron.php execution and the resulting security updates, and the source code describes "the scenario where a site may not receive enough visits to execute scheduled tasks in a timely manner," but neither the installation guide nor the security guide mentions this default behavior, or alerts the user about security risks on installations with very few visits. WordPress hasta 6.1.1 depende de visitas impredecibles de clientes para provoc... • https://github.com/michael-david-fry/CVE-2023-22622 •
CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 1CVE-2022-4392 – iPanorama 360 WordPress Virtual Tour Builder <= 1.6.29 - Contributor+ Stored XSS
https://notcve.org/view.php?id=CVE-2022-4392
16 Dec 2022 — The iPanorama 360 WordPress Virtual Tour Builder plugin through 1.6.29 does not sanitise and escape some of its settings, which could allow users such as contributor+ to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed. The iPanorama 360 WordPress Virtual Tour Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode in versions up to, and including, 1.6.29 due to insufficient input sanitization and output escaping.... • https://wpscan.com/vulnerability/c298e3dc-09a7-40bb-a361-f49af4bce77e • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 1CVE-2022-4142 – WordPress Filter Gallery Plugin < 0.1.6 - Admin+ Stored XSS
https://notcve.org/view.php?id=CVE-2022-4142
06 Dec 2022 — The WordPress Filter Gallery Plugin WordPress plugin before 0.1.6 does not properly escape the filters passed in the ufg_gallery_filters ajax action before outputting them on the page, allowing a high privileged user such as an administrator to inject HTML or javascript to the plugin settings page, even when the unfiltered_html capability is disabled. El complemento Filter Gallery de WordPress anterior a 0.1.6 no escapa correctamente a los filtros pasados en la acción ajax ufg_gallery_filters antes de mostr... • https://wpscan.com/vulnerability/8c2adadd-0684-49a8-9185-0c7d9581aef1 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.4EPSS: 0%CPEs: 24EXPL: 0CVE-2022-43500
https://notcve.org/view.php?id=CVE-2022-43500
05 Dec 2022 — Cross-site scripting vulnerability in WordPress versions prior to 6.0.3 allows a remote unauthenticated attacker to inject an arbitrary script. The developer also provides new patched releases for all versions since 3.7. Una vulnerabilidad de Cross-Site Scripting en versiones de WordPress anteriores a la 6.0.3 permite que un atacante remoto no autenticado inyecte un script arbitrario. El desarrollador también proporciona nuevas versiones parcheadas para todas las versiones desde la 3.7. • https://jvn.jp/en/jp/JVN09409909/index.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2022-43468 – WordPress Popular Posts <= 6.0.5 - Unauthenticated Views Changes
https://notcve.org/view.php?id=CVE-2022-43468
18 Nov 2022 — External initialization of trusted variables or data stores vulnerability exists in WordPress Popular Posts 6.0.5 and earlier, therefore the vulnerable product accepts untrusted external inputs to update certain internal variables. As a result, the number of views for an article may be manipulated through a crafted input. Vulnerabilidad de inicialización externa de variables confiables o almacenes de datos existe en WordPress Popular Posts 6.0.5 y versiones anteriores, por lo tanto, el producto vulnerable a... • https://github.com/cabrerahector/wordpress-popular-posts • CWE-284: Improper Access Control CWE-665: Improper Initialization •
CVSS: 8.8EPSS: 0%CPEs: 24EXPL: 0CVE-2022-43497 – WordPress Core < 6.0.3 - Reflected Cross-Site Scripting via SQL Injection
https://notcve.org/view.php?id=CVE-2022-43497
18 Oct 2022 — Cross-site scripting vulnerability in WordPress versions prior to 6.0.3 allows a remote unauthenticated attacker to inject an arbitrary script. The developer also provides new patched releases for all versions since 3.7. Una vulnerabilidad de Cross-Site Scripting en versiones de WordPress anteriores a la 6.0.3 permite que un atacante remoto no autenticado inyecte un script arbitrario. El desarrollador también proporciona nuevas versiones parcheadas para todas las versiones desde la 3.7. WordPress Core is vu... • https://jvn.jp/en/jp/JVN09409909/index.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.3EPSS: 1%CPEs: 24EXPL: 0CVE-2022-43504 – WordPress Core < 6.0.3 - Information Disclosure (Email Address)
https://notcve.org/view.php?id=CVE-2022-43504
18 Oct 2022 — Improper authentication vulnerability in WordPress versions prior to 6.0.3 allows a remote unauthenticated attacker to obtain the email address of the user who posted a blog using the WordPress Post by Email Feature. The developer also provides new patched releases for all versions since 3.7. Una vulnerabilidad de autenticación inadecuada en las versiones de WordPress anteriores a la 6.0.3 permite que un atacante remoto no autenticado obtenga la dirección de correo electrónico del usuario que publicó un blo... • https://jvn.jp/en/jp/JVN09409909/index.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-287: Improper Authentication •