CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 1CVE-2024-1526 – Hubbub Lite < 1.33.1 - Unauthenticated Password Protected Posts Access
https://notcve.org/view.php?id=CVE-2024-1526
The Hubbub Lite WordPress plugin before 1.33.1 does not ensure that user have access to password protected post before displaying its content in a meta tag. El complemento Hubbub Lite de WordPress anterior a 1.33.1 no garantiza que el usuario tenga acceso a una publicación protegida con contraseña antes de mostrar su contenido en una metaetiqueta. The Hubbub Lite – Fast, Reliable Social Sharing Buttons plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.33.0 via opengraph tags. This makes it possible for unauthenticated attackers to view short excerpts of password protected posts. • https://wpscan.com/vulnerability/1664697e-0ea3-4d09-b2fd-153a104ec255 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 4.8EPSS: 0%CPEs: 1EXPL: 1CVE-2023-7154 – Hubbub Lite < 1.32.0 - Admin+ Stored XSS
https://notcve.org/view.php?id=CVE-2023-7154
The Hubbub Lite (formerly Grow Social) WordPress plugin before 1.32.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) El complemento de WordPress Hubbub Lite (anteriormente Grow Social) anterior a 1.32.0 no sanitiza ni escapa a algunas de sus configuraciones, lo que podría permitir a usuarios con altos privilegios, como el administrador, realizar ataques de cross site scripting almacenado incluso cuando la capacidad unfiltered_html no está permitida (por ejemplo en configuración multisitio) The Hubbub Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.31.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. • https://wpscan.com/vulnerability/0ed423dd-4a38-45e0-8645-3f4215a3f15c • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •