CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2023-48288 – WordPress WordPress Job Board and Recruitment Plugin – JobWP Plugin <= 2.1 is vulnerable to Sensitive Data Exposure
https://notcve.org/view.php?id=CVE-2023-48288
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in HM Plugin WordPress Job Board and Recruitment Plugin – JobWP.This issue affects WordPress Job Board and Recruitment Plugin – JobWP: from n/a through 2.1. Vulnerabilidad de exposición de información confidencial a un actor no autorizado en HM Plugin WordPress Job Board and Recruitment Plugin – JobWP. Este problema afecta a WordPress Job Board and Recruitment Plugin – JobWP: desde n/a hasta 2.1. The WordPress Job Board and Recruitment Plugin – JobWP plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.1. This makes it possible for unauthenticated attackers to extract sensitive user data via resumes. • https://patchstack.com/database/vulnerability/jobwp/wordpress-jobwp-plugin-2-1-sensitive-data-exposure-on-resume-files-vulnerability?_s_id=cve • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 1CVE-2023-29384 – WordPress WordPress Job Board and Recruitment Plugin – JobWP Plugin <= 2.0 is vulnerable to Arbitrary File Upload
https://notcve.org/view.php?id=CVE-2023-29384
Unrestricted Upload of File with Dangerous Type vulnerability in HM Plugin WordPress Job Board and Recruitment Plugin – JobWP.This issue affects WordPress Job Board and Recruitment Plugin – JobWP: from n/a through 2.0. Carga sin restricciones de archivos con vulnerabilidad de tipo peligroso en HM Plugin WordPress Job Board and Recruitment Plugin – JobWP. Este problema afecta a WordPress Job Board y Recruitment Plugin – JobWP: desde n/a hasta 2.0. The WordPress Job Board and Recruitment Plugin plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'jobwp_upload_resume' function in versions up to, and including, 2.0. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. • https://github.com/nastar-id/CVE-2023-29384 https://patchstack.com/database/vulnerability/jobwp/wordpress-job-board-and-recruitment-plugin-jobwp-plugin-2-0-arbitrary-file-upload-vulnerability?_s_id=cve • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2023-23705 – WordPress Books Gallery Plugin <= 4.4.8 is vulnerable to Cross Site Request Forgery (CSRF)
https://notcve.org/view.php?id=CVE-2023-23705
Cross-Site Request Forgery (CSRF) vulnerability in HM Plugin WordPress Books Gallery plugin <= 4.4.8 versions. The WordPress Books Gallery plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.4.8. This is due to missing or incorrect nonce validation on the 'wbg-api-import.php' file and the functions 'wbg_gallery_settings', 'wbg_search_panel_settings', and 'wbg_details_settings'. This makes it possible for unauthenticated attackers to change plugin settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. • https://patchstack.com/database/vulnerability/wp-books-gallery/wordpress-wordpress-books-gallery-plugin-4-4-8-cross-site-request-forgery-csrf-vulnerability?_s_id=cve • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2022-47422 – WordPress WordPress Stripe Donation and Payment Plugin Plugin <= 3.1.5 is vulnerable to Cross Site Request Forgery (CSRF)
https://notcve.org/view.php?id=CVE-2022-47422
Cross-Site Request Forgery (CSRF) vulnerability in HM Plugin Accept Stripe Donation – AidWP plugin <= 3.1.5 versions. The Accept Stripe Donation – AidWP plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.1.5. This is due to missing or incorrect nonce validation on an unknown function. This makes it possible for unauthenticated attackers to perform an unknown action granted they can trick a site administrator into performing an action such as clicking on a link. The impact of this vulnerability is unknown. • https://patchstack.com/database/vulnerability/wp-stripe-donation/wordpress-wordpress-stripe-donation-plugin-3-1-5-cross-site-request-forgery-csrf?_s_id=cve • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 1CVE-2021-24602 – HM Multiple Roles < 1.3 - Arbitrary Role Change
https://notcve.org/view.php?id=CVE-2021-24602
The HM Multiple Roles WordPress plugin before 1.3 does not have any access control to prevent low privilege users to set themselves as admin via their profile page El plugin de WordPress HM Múltiple Roles versiones anteriores a 1.3, no presenta ningún control de acceso para evitar a usuarios pocos privilegiados se establezcan como administradores por medio de su página de perfil. • https://jetpack.com/2021/08/05/privilege-escalation-in-hm-multiple-roles-wordpress-plugin https://wpscan.com/vulnerability/5fd2548a-08de-4417-bff1-f174dab718d5 • CWE-269: Improper Privilege Management CWE-669: Incorrect Resource Transfer Between Spheres •