CVSS: 8.8EPSS: 0%CPEs: 2EXPL: 1CVE-2020-35939 – Team Showcase <= 1.22.15 - Object Injection
https://notcve.org/view.php?id=CVE-2020-35939
17 Sep 2020 — PHP Object injection vulnerabilities in the Team Showcase plugin before 1.22.16 for WordPress allow remote authenticated attackers to inject arbitrary PHP objects due to insecure unserialization of data supplied in a remotely hosted crafted payload in the source parameter via AJAX. The action must be set to team_import_xml_layouts. Unas vulnerabilidades de inyección de objetos PHP en el plugin Team Showcase versiones anteriores a 1.22.16 para WordPress, permiten a atacantes autenticados remotos inyectar obj... • https://www.wordfence.com/blog/2020/10/high-severity-vulnerabilities-in-post-grid-and-team-showcase-plugins • CWE-502: Deserialization of Untrusted Data •
CVSS: 8.8EPSS: 0%CPEs: 2EXPL: 1CVE-2020-35938 – Team Showcase <= 1.22.15 - Object Injection
https://notcve.org/view.php?id=CVE-2020-35938
17 Sep 2020 — PHP Object injection vulnerabilities in the Post Grid plugin before 2.0.73 for WordPress allow remote authenticated attackers to inject arbitrary PHP objects due to insecure unserialization of data supplied in a remotely hosted crafted payload in the source parameter via AJAX. The action must be set to post_grid_import_xml_layouts. Unas vulnerabilidades de inyección de objetos PHP en el plugin Post Grid versiones anteriores a 2.0.73 para WordPress, permiten a atacantes autenticados remotos inyectar objetos ... • https://www.wordfence.com/blog/2020/10/high-severity-vulnerabilities-in-post-grid-and-team-showcase-plugins • CWE-502: Deserialization of Untrusted Data •
CVSS: 8.0EPSS: 0%CPEs: 2EXPL: 1CVE-2020-35936 – Team Showcase <= 1.22.15 - Stored Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2020-35936
17 Sep 2020 — Stored Cross-Site Scripting (XSS) vulnerabilities in the Post Grid plugin before 2.0.73 for WordPress allow remote authenticated attackers to import layouts including JavaScript supplied via a remotely hosted crafted payload in the source parameter via AJAX. The action must be set to post_grid_import_xml_layouts. Unas vulnerabilidades de tipo Cross-Site Scripting (XSS) almacenado en el plugin Post Grid versiones anteriores a 2.0.73 para WordPress, permiten a atacantes autenticados remotos importar diseños q... • https://www.wordfence.com/blog/2020/10/high-severity-vulnerabilities-in-post-grid-and-team-showcase-plugins • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.0EPSS: 0%CPEs: 2EXPL: 1CVE-2020-35937 – Team Showcase <= 1.22.15 - Stored Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2020-35937
17 Sep 2020 — Stored Cross-Site Scripting (XSS) vulnerabilities in the Team Showcase plugin before 1.22.16 for WordPress allow remote authenticated attackers to import layouts including JavaScript supplied via a remotely hosted crafted payload in the source parameter via AJAX. The action must be set to team_import_xml_layouts. Unas vulnerabilidades de tipo Cross-Site Scripting (XSS) almacenado en el plugin Team Showcase versiones anteriores a 1.22.16 para WordPress, permiten a atacantes autenticados remotos importar dise... • https://www.wordfence.com/blog/2020/10/high-severity-vulnerabilities-in-post-grid-and-team-showcase-plugins • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •