CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2024-49272 – WordPress Social Auto Poster plugin <= 5.3.15 - Cross Site Request Forgery (CSRF) vulnerability
https://notcve.org/view.php?id=CVE-2024-49272
Cross-Site Request Forgery (CSRF) vulnerability in WPWeb Social Auto Poster allows Cross Site Request Forgery.This issue affects Social Auto Poster: from n/a through 5.3.15. The Social Auto Poster plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.3.15. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to perform unauthorized actions via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. • https://patchstack.com/database/vulnerability/social-auto-poster/wordpress-social-auto-poster-plugin-5-3-15-cross-site-request-forgery-csrf-vulnerability?_s_id=cve • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 7.1EPSS: 0%CPEs: 1EXPL: 0CVE-2024-47369 – WordPress Social Auto Poster plugin <= 5.3.15 - Reflected Cross Site Scripting (XSS) vulnerability
https://notcve.org/view.php?id=CVE-2024-47369
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WPWeb Social Auto Poster allows Reflected XSS.This issue affects Social Auto Poster: from n/a through 5.3.15. The Social Auto Poster plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 5.3.15 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. • https://patchstack.com/database/vulnerability/social-auto-poster/wordpress-social-auto-poster-plugin-5-3-15-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.3EPSS: 0%CPEs: 1EXPL: 0CVE-2024-6750 – Social Auto Poster <= 5.3.14 - Missing Authorization via Multiple Functions
https://notcve.org/view.php?id=CVE-2024-6750
The Social Auto Poster plugin for WordPress is vulnerable to unauthorized access, modification, and loss of data due to a missing capability check on multiple functions in all versions up to, and including, 5.3.14. This makes it possible for unauthenticated attackers to add, modify, or delete post meta and plugin options. El complemento Social Auto Poster para WordPress es vulnerable al acceso no autorizado, modificación y pérdida de datos debido a una falta de verificación de capacidad en múltiples funciones en todas las versiones hasta la 5.3.14 incluida. Esto hace posible que atacantes no autenticados agreguen, modifiquen o eliminen opciones de complementos y metadatos de publicaciones. • https://codecanyon.net/item/social-auto-poster-wordpress-scheduler-marketing-plugin/5754169 https://www.wordfence.com/threat-intel/vulnerabilities/id/36b58a4f-0761-4775-9010-9c77d4019c44?source=cve • CWE-862: Missing Authorization •
CVSS: 6.3EPSS: 0%CPEs: 1EXPL: 0CVE-2024-6751 – Social Auto Poster <= 5.3.14 - Cross-Site Request Forgery via Multiple Functions
https://notcve.org/view.php?id=CVE-2024-6751
The Social Auto Poster plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.3.14. This is due to missing or incorrect nonce validation on multiple functions. This makes it possible for unauthenticated attackers to add, modify, or delete post meta and plugin options. El complemento Social Auto Poster para WordPress es vulnerable a Cross-Site Request Forgery en versiones hasta la 5.3.14 incluida. Esto se debe a una validación nonce faltante o incorrecta en múltiples funciones. • https://codecanyon.net/item/social-auto-poster-wordpress-scheduler-marketing-plugin/5754169 https://www.wordfence.com/threat-intel/vulnerabilities/id/d7aceccc-7004-42f2-b085-eade9c45141c?source=cve • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0CVE-2024-6754 – Social Auto Poster <= 5.3.14 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Meta Update via wpw_auto_poster_update_tweet_template
https://notcve.org/view.php?id=CVE-2024-6754
The Social Auto Poster plugin for WordPress is vulnerable to unauthorized modification of data to a missing capability check on the ‘wpw_auto_poster_update_tweet_template’ function in all versions up to, and including, 5.3.14. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary post metadata. El complemento Social Auto Poster para WordPress es vulnerable a modificaciones no autorizadas de datos debido a una verificación de capacidad faltante en la función 'wpw_auto_poster_update_tweet_template' en todas las versiones hasta la 5.3.14 incluida. Esto hace posible que atacantes autenticados, con acceso a nivel de suscriptor y superior, actualicen metadatos de publicaciones arbitrarias. • https://codecanyon.net/item/social-auto-poster-wordpress-scheduler-marketing-plugin/5754169 https://www.wordfence.com/threat-intel/vulnerabilities/id/72934d2f-fd52-46d1-8cf9-9a20968899f7?source=cve • CWE-862: Missing Authorization •