CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 0CVE-2024-8799 – Custom Banners <= 3.3 - Reflected Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2024-8799
30 Sep 2024 — The Custom Banners plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 3.3. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. El complemento Custom Banners para WordPress es vulnerable a ataques Cross-Site Scripting reflejado debido al ... • https://plugins.trac.wordpress.org/browser/custom-banners/trunk/include/tgmpa/init.php#L96 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.0EPSS: 0%CPEs: 1EXPL: 0CVE-2021-4407 – Custom Banners <= 3.2.2 - Cross-Site Request Forgery Bypass
https://notcve.org/view.php?id=CVE-2021-4407
01 Mar 2021 — The Custom Banners plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.2.2 This is due to missing or incorrect nonce validation on the saveCustomFields() function. This makes it possible for unauthenticated attackers to save custom fields via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. • https://blog.nintechnet.com/25-wordpress-plugins-vulnerable-to-csrf-attacks • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 7.1EPSS: 0%CPEs: 1EXPL: 1CVE-2014-4724 – Custom Banners < 2.1 - Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2014-4724
29 Jun 2014 — Cross-site scripting (XSS) vulnerability in the Custom Banners plugin 1.2.2.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the custom_banners_registered_name parameter to wp-admin/options.php. Vulnerabilidad de XSS en el plugin Custom Banners 1.2.2.2 para WordPress permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a través del parámetro custom_banners_registered_name en wp-admin/options.php. Cross-site scripting (XSS) vulnerability in the ... • http://packetstormsecurity.com/files/127291/WordPress-Custom-Banners-1.2.2.2-Cross-Site-Scripting.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •