CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2023-41129 – WordPress Patreon WordPress Plugin <= 1.8.6 is vulnerable to Cross Site Request Forgery (CSRF)
https://notcve.org/view.php?id=CVE-2023-41129
Cross-Site Request Forgery (CSRF) vulnerability in Patreon Patreon WordPress.This issue affects Patreon WordPress: from n/a through 1.8.6. Vulnerabilidad de Cross-Site Request Forgery (CSRF) en Patreon Patreon WordPress. Este problema afecta a Patreon WordPress: desde n/a hasta 1.8.6. The Patreon WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.8.7. This is due to missing or incorrect nonce validation on several functions in the ~/classes/patreon_wordpress.php file. • https://patchstack.com/database/vulnerability/patreon-connect/wordpress-patreon-wordpress-plugin-1-8-6-cross-site-request-forgery-csrf-vulnerability?_s_id=cve • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 1CVE-2021-25026 – Patreon WordPress < 1.8.2 - Admin+ Stored Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2021-25026
The Patreon WordPress plugin before 1.8.2 does not sanitise and escape the field "Custom Patreon Page name", which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed El plugin Patreon de WordPress versiones anteriores a 1.8.2, no sanea y escapa del campo "Custom Patreon Page name", lo que podría permitir a usuarios con altos privilegios llevar a cabo ataques de tipo Cross-Site Scripting incluso cuando la capacidad unfiltered_html está deshabilitada The Patreon WordPress plugin for WordPress is vulnerable to Cross-Site Scripting in versions up to, and including, 1.8.1 due to insufficient privilege handling. This makes it possible for high-privilege users attackers to inject arbitrary web scripts that execute in a victim's browser even when the unfiltered_html capability is disallowed. • https://plugins.trac.wordpress.org/changeset/2682069 https://wpscan.com/vulnerability/02756dd3-832a-4846-b9e1-a34f148b5cfe • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 3%CPEs: 1EXPL: 1CVE-2021-24227 – Patreon WordPress < 1.7.0 - Unauthenticated Local File Disclosure
https://notcve.org/view.php?id=CVE-2021-24227
The Jetpack Scan team identified a Local File Disclosure vulnerability in the Patreon WordPress plugin before 1.7.0 that could be abused by anyone visiting the site. Using this attack vector, an attacker could leak important internal files like wp-config.php, which contains database credentials and cryptographic keys used in the generation of nonces and cookies. El equipo de Jetpack Scan identificó una vulnerabilidad de Divulgación de Archivos Locales en el plugin Patreon WordPress versiones anteriores a 1.7.0, que podría ser abusado por cualquiera que visite el sitio. Con este vector de ataque, un atacante podría filtrar archivos internos importantes como wp-config.php, que contiene credenciales de base de datos y claves criptográficas utilizadas en la generación de nonces y cookies • https://jetpack.com/2021/03/26/vulnerabilities-found-in-patreon-wordpress-plugin https://wpscan.com/vulnerability/f62df02d-7678-440f-84a1-ddbf09364016 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 1CVE-2021-24231 – Patreon WordPress < 1.7.0 - CSRF to Disconnect Sites From Patreon
https://notcve.org/view.php?id=CVE-2021-24231
The Jetpack Scan team identified a Cross-Site Request Forgery vulnerability in the Patreon WordPress plugin before 1.7.0, allowing attackers to make a logged administrator disconnect the site from Patreon by visiting a specially crafted link. El equipo de Jetpack Scan identificó una vulnerabilidad de tipo Cross-Site Request Forgery en el plugin Patreon de WordPress versiones anteriores a 1.7.0, permitiendo a un atacante hacer que un administrador registrado desconecte el sitio de Patreon al visitar un enlace especialmente diseñado • https://jetpack.com/2021/03/26/vulnerabilities-found-in-patreon-wordpress-plugin https://wpscan.com/vulnerability/f8ab6855-a319-47ac-82fb-58b181e77500 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 9.6EPSS: 0%CPEs: 1EXPL: 1CVE-2021-24229 – Patreon WordPress < 1.7.2 - Reflected XSS on patreon_save_attachment_patreon_level AJAX action
https://notcve.org/view.php?id=CVE-2021-24229
The Jetpack Scan team identified a Reflected Cross-Site Scripting via the patreon_save_attachment_patreon_level AJAX action of the Patreon WordPress plugin before 1.7.2. This AJAX hook is used to update the pledge level required by Patreon subscribers to access a given attachment. This action is accessible for user accounts with the ‘manage_options’ privilege (i.e.., only administrators). Unfortunately, one of the parameters used in this AJAX endpoint is not sanitized before being printed back to the user, so the risk it represents is the same as the previous XSS vulnerability. El equipo de Jetpack Scan identificó una vulnerabilidad de tipo Cross-Site Scripting Reflejado por medio de la acción AJAX patreon_save_attachment_patreon_level del plugin Patreon WordPress versiones anteriores a 1.7.2. • https://jetpack.com/2021/03/26/vulnerabilities-found-in-patreon-wordpress-plugin https://wpscan.com/vulnerability/001755c4-add3-4566-a022-ab1f83546c1f • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •