CVSS: 7.1EPSS: 0%CPEs: 1EXPL: 0CVE-2023-47766 – WordPress Post Status Notifier Lite Plugin <= 1.11.0 is vulnerable to Cross Site Scripting (XSS)
https://notcve.org/view.php?id=CVE-2023-47766
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Timo Reith Post Status Notifier Lite plugin <= 1.11.0 versions. Vulnerabilidad de neutralización inadecuada de la entrada durante la generación de páginas web ('cross-site Scripting') en el complemento Timo Reith Post Status Notifier Lite en versiones <= 1.11.0. The Post Status Notifier Lite plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 1.11.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. • https://patchstack.com/database/vulnerability/post-status-notifier-lite/wordpress-post-status-notifier-lite-plugin-1-11-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2023-27417 – WordPress Affiliate Super Assistent Plugin <= 1.5.1 is vulnerable to Cross Site Request Forgery (CSRF)
https://notcve.org/view.php?id=CVE-2023-27417
Cross-Site Request Forgery (CSRF) vulnerability in Timo Reith Affiliate Super Assistent plugin <= 1.5.1 versions. Vulnerabilidad de Cross-Site Request Forgery (CSRF) en el complemento Timo Reith Affiliate Super Assistent en versiones <= 1.5.1. The Affiliate Super Assistent plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.5.1. This is due to missing or incorrect nonce validation on several functions such as the '_displayPreDispatcher', '_displayDispatcher', & '_displayTestPage' functions. This makes it possible for unauthenticated attackers to perform many actions like updating plugin settings via a forged request, granted they can trick a site administrator into performing an action such as clicking on a link. • https://patchstack.com/database/vulnerability/amazonsimpleadmin/wordpress-affiliate-super-assistent-plugin-1-5-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2022-4325 – Post Status Notifier Lite < 1.10.1 - Reflected XSS
https://notcve.org/view.php?id=CVE-2022-4325
The Post Status Notifier Lite WordPress plugin before 1.10.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which can be used against high privilege users such as admin. The Post Status Notifier Lite plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the $controller parameter in versions up to, and including, 1.10.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. • https://wpscan.com/vulnerability/5b983c48-6b05-47cf-85cb-28bbeec17395 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •