CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2024-22158 – WordPress PeepSo Core: Photos Plugin < 6.3.1.0 is vulnerable to Cross Site Scripting (XSS)
https://notcve.org/view.php?id=CVE-2024-22158
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PeepSo Community by PeepSo – Social Network, Membership, Registration, User Profiles allows Stored XSS.This issue affects Community by PeepSo – Social Network, Membership, Registration, User Profiles: from n/a before 6.3.1.0. La vulnerabilidad de neutralización incorrecta de la entrada durante de generación de páginas web ('Cross-site Scripting') en PeepSo Community by PeepSo – Social Network, Membership, Registration, User Profiles permite XSS almacenado. Este problema afecta a Community by PeepSo – Social Network, Membership, Registration, User Profiles: desde n/a antes de 6.3.1.0. The PeepSo Core: Photos plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an unknown parameter in versions up to 6.3.1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. • https://patchstack.com/database/vulnerability/peepso-photos/wordpress-peepso-photos-add-on-plugin-6-3-1-0-cross-site-scripting-xss-vulnerability?_s_id=cve • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 1CVE-2023-7125 – Community by PeepSo < 6.3.1.2 - User Post Creation via CSRF
https://notcve.org/view.php?id=CVE-2023-7125
The Community by PeepSo WordPress plugin before 6.3.1.2 does not have CSRF check when creating a user post (visible on their wall in their profile page), which could allow attackers to make logged in users perform such action via a CSRF attack El complemento de WordPress Community by PeepSo anterior a 6.3.1.2 no tiene verificación CSRF al crear una publicación de usuario (visible en su muro en su página de perfil), lo que podría permitir a los atacantes hacer que los usuarios que han iniciado sesión realicen dicha acción a través de un ataque CSRF. The Community by PeepSo – Social Network, Membership, Registration, User Profiles plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.3.1.1. This is due to missing or incorrect nonce validation. This makes it possible for unauthenticated attackers to create user posts on other members walls via a forged request granted they can trick a sites' user into performing an action such as clicking on a link. CVE-2024-31251 appears to be a potential duplicate of this issue. • https://wpscan.com/vulnerability/cac12b64-ed25-4ee2-933f-8ff722605271 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2024-0187 – Community by PeepSo < 6.3.1.2 - Reflected XSS
https://notcve.org/view.php?id=CVE-2024-0187
The Community by PeepSo WordPress plugin before 6.3.1.2 does not sanitise and escape various parameters and generated URLs before outputting them back attributes, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin El complemento de WordPress Community by PeepSo anterior a 6.3.1.2 no sanitiza ni escapa de varios parámetros y URL generadas antes de devolverles los atributos, lo que genera cross site scripting reflejado que podría usarse contra usuarios con privilegios elevados, como el administrador. The Community by PeepSo plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 6.3.1.1. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. • https://wpscan.com/vulnerability/b4600411-bee1-4cc8-aee9-0a613ac9b55b • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.1EPSS: 0%CPEs: 1EXPL: 0CVE-2023-48746 – WordPress Community by PeepSo Plugin <= 6.2.6.0 is vulnerable to Cross Site Scripting (XSS)
https://notcve.org/view.php?id=CVE-2023-48746
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PeepSo Community by PeepSo – Social Network, Membership, Registration, User Profiles allows Reflected XSS.This issue affects Community by PeepSo – Social Network, Membership, Registration, User Profiles: from n/a through 6.2.6.0. Neutralización inadecuada de la entrada durante Vulnerabilidad de generación de páginas web ('Scripting entre sitios') en PeepSo Community by PeepSo – Social Network, Membership, Registration, User Profiles permite XSS reflejado. Este problema afecta a Community by PeepSo – Social Network, Membership, Registration, User Profiles: desde n/a hasta 6.2.6.0. The Community by PeepSo – Social Network, Membership, Registration, User Profiles plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via an unknown parameter in all versions up to, and including, 6.2.6.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. • https://patchstack.com/database/vulnerability/peepso-core/wordpress-community-by-peepso-plugin-6-2-6-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2023-47850 – WordPress Community by PeepSo Plugin <= 6.2.2.0 is vulnerable to Cross Site Scripting (XSS)
https://notcve.org/view.php?id=CVE-2023-47850
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PeepSo Community by PeepSo – Social Network, Membership, Registration, User Profiles allows Stored XSS.This issue affects Community by PeepSo – Social Network, Membership, Registration, User Profiles: from n/a through 6.2.2.0. Neutralización inadecuada de la entrada durante la vulnerabilidad de generación de páginas web ('Cross-site Scripting') en PeepSo Community by PeepSo – Social Network, Membership, Registration, User Profiles permite almacenar XSS. Este problema afecta a Community by PeepSo – Social Network, Membership, Registration, User Profiles: desde n/a hasta 6.2.2.0. The Community by PeepSo – Social Network, Membership, Registration, User Profiles plugin for WordPress is vulnerable to Stored Cross-Site Scripting via user avatars in all versions up to, and including, 6.2.2.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. • https://patchstack.com/database/vulnerability/peepso-core/wordpress-community-by-peepso-plugin-6-2-2-0-cross-site-scripting-xss-vulnerability?_s_id=cve • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •