CVSS: 3.5EPSS: 0%CPEs: 1EXPL: 1CVE-2025-1452 – Favorites < 2.3.5 - Admin+ Stored XSS
https://notcve.org/view.php?id=CVE-2025-1452
25 Mar 2025 — The Favorites WordPress plugin before 2.3.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). • https://wpscan.com/vulnerability/47365daf-7ef5-471a-ab0e-f6d1b40ca56c •
CVSS: 7.2EPSS: 0%CPEs: 1EXPL: 0CVE-2024-2948 – Favorites <= 2.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
https://notcve.org/view.php?id=CVE-2024-2948
29 Mar 2024 — The Favorites plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'user_favorites' shortcode in all versions up to, and including, 2.3.3 due to insufficient input sanitization and output escaping on user supplied attributes such as 'no_favorites'. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. El complemento Favoritos para WordPres... • https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3061244%40favorites&new=3061244%40favorites&sfp_email=&sfph_mail= • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 0CVE-2023-2304 – Favorites <= 2.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
https://notcve.org/view.php?id=CVE-2023-2304
30 May 2023 — The Favorites plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'user_favorites' shortcode in versions up to, and including, 2.3.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. • https://plugins.trac.wordpress.org/browser/favorites/tags/2.3.2/app/API/Shortcodes/UserFavoritesShortcode.php#L57 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.3EPSS: 1%CPEs: 2EXPL: 0CVE-2021-26024
https://notcve.org/view.php?id=CVE-2021-26024
03 Feb 2021 — The Favorites component before 1.0.2 for Nagios XI 5.8.0 is vulnerable to Insecure Direct Object Reference: it is possible to create favorites for any other user account. El plugin Favorites versiones anteriores a 1.0.2 para Nagios XI versión 5.8.0, es vulnerable a una Referencia Directa a Objetos No Segura: es posible crear favoritos para cualquier otra cuenta de usuario • https://www.nagios.com/products/security • CWE-639: Authorization Bypass Through User-Controlled Key •
CVSS: 6.1EPSS: 59%CPEs: 2EXPL: 0CVE-2021-26023
https://notcve.org/view.php?id=CVE-2021-26023
03 Feb 2021 — The Favorites component before 1.0.2 for Nagios XI 5.8.0 is vulnerable to XSS. El plugin Favorites versiones anteriores a 1.0.2 para Nagios XI versión 5.8.0, es vulnerable a un ataque de tipo XSS • https://www.nagios.com/products/security • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •