CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 1CVE-2022-36373 – WordPress MP3 jPlayer plugin <= 2.7.3 - Multiple Cross-Site Request Forgery (CSRF) vulnerabilities
https://notcve.org/view.php?id=CVE-2022-36373
Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in Simon Ward MP3 jPlayer plugin <= 2.7.3 at WordPress. Múltiples vulnerabilidades de tipo Cross-Site Request Forgery (CSRF) en el plugin Simon Ward MP3 jPlayer versiones anteriores a 2.7.3 incluyéndola, en WordPress The MP3 jPlayer plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.7.3. This is due to missing or incorrect nonce validation on several of its functions. This makes it possible for unauthenticated attackers to execute them, via forged request granted they can trick a site administrator into performing an action such as clicking on a link. • https://patchstack.com/database/vulnerability/mp3-jplayer/wordpress-mp3-jplayer-plugin-2-7-3-multiple-cross-site-request-forgery-csrf-vulnerabilities https://wordpress.org/plugins/mp3-jplayer • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2015-1000008 – MP3-jPlayer <= 2.4.2 - Full Path Disclosure
https://notcve.org/view.php?id=CVE-2015-1000008
Path Disclosure Vulnerability in wordpress plugin MP3-jPlayer v2.3.2 Vulnerabilidad en Path Disclosure en plugin de wordpress MP3-jPlayer v2.3.2 The MP3-jPlayer plugin for WordPress is vulnerable to Path Disclosure in versions before 2.5. • http://www.vapidlabs.com/advisory.php?v=149 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •