CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2024-8544 – Pixel Cat – Conversion Pixel Manager <= 3.0.5 - Reflected Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2024-8544
The Pixel Cat – Conversion Pixel Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 3.0.5. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. • https://plugins.trac.wordpress.org/browser/facebook-conversion-pixel/trunk/includes/notices/notices.php?rev=2918763#L81 https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3151635%40facebook-conversion-pixel&new=3151635%40facebook-conversion-pixel&sfp_email=&sfph_mail= https://www.wordfence.com/threat-intel/vulnerabilities/id/fc4f4a78-7224-4f58-a103-7ad4df0eb36e?source=cve • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.0EPSS: 0%CPEs: 1EXPL: 1CVE-2021-24922 – Pixel Cat Lite < 2.6.2 - CSRF to Stored Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2021-24922
The Pixel Cat WordPress plugin before 2.6.2 does not have CSRF check when saving its settings, and did not sanitise as well as escape some of them, which could allow attacker to make a logged in admin change them and perform Cross-Site Scripting attacks El plugin Pixel Cat de WordPress versiones anteriores a 2.6.2, no presenta una comprobación de tipo CSRF al guardar sus configuraciones, y no sanea así como escapa de algunas de ellas, lo que podría permitir a un atacante hacer que un administrador registrado las cambie y realice ataques de tipo Cross-Site Scripting The Pixel Cat – Conversion Pixel Manager WordPress plugin before 2.6.2 does not have CSRF check when saving its settings, and did not sanitise as well as escape some of them, which could allow attacker to make a logged in admin change them and perform Cross-Site Scripting attacks • https://wpscan.com/vulnerability/399ffd65-f3c0-4fbe-a83a-2a620976aad2 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 4.8EPSS: 0%CPEs: 1EXPL: 1CVE-2021-24972 – Pixel Cat Lite < 2.6.3 - Admin+ Stored Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2021-24972
The Pixel Cat WordPress plugin before 2.6.3 does not escape some of its settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed El plugin Pixel Cat de WordPress versiones anteriores a 2.6.3, no escapa a algunas de sus configuraciones, lo que podría permitir a usuarios muy privilegiados llevar a cabo ataques de tipo Cross-Site Scripting incluso cuando el unfiltered_html está deshabilitado • https://wpscan.com/vulnerability/b960cb36-62de-4b9f-a35d-144a34a4c63d • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •