CVSS: 5.9EPSS: 0%CPEs: 1EXPL: 1CVE-2024-6231 – Request a Quote < 2.4.1 - Admin+ Stored XSS
https://notcve.org/view.php?id=CVE-2024-6231
The Request a Quote WordPress plugin before 2.4.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) El complemento de WordPress Request a Quote anterior a 2.4.1 no sanitiza ni escapa a algunas de sus configuraciones, lo que podría permitir a usuarios con privilegios elevados, como el administrador, realizar ataques de Cross Site Scripting almacenado incluso cuando la capacidad unfiltered_html no está permitida (por ejemplo, en la configuración de múltiples sitios). The Request a Quote plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.4.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. • https://wpscan.com/vulnerability/75ad1d8f-edc3-4eb3-b4c0-73832c0a4ca0 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 1CVE-2022-2240 – Request a Quote <= 2.3.7 - CSV Injection
https://notcve.org/view.php?id=CVE-2022-2240
The Request a Quote WordPress plugin through 2.3.7 does not validate uploaded CSV files, allowing unauthenticated users to attach a malicious CSV file to a quote, which could lead to a CSV injection once an admin download and open it El plugin Request a Quote de WordPress versiones hasta 2.3.7, no comprueba los archivos CSV subidos, lo que permite a usuarios no autenticados adjuntar un archivo CSV malicioso a un presupuesto, lo que podría conllevar a una inyección CSV una vez que un administrador lo descargue y lo abra The Request a Quote WordPress plugin through 2.3.8 does not validate uploaded CSV files, allowing unauthenticated users to attach a malicious CSV file to a quote, which could lead to a CSV injection once an admin download and open it • https://wpscan.com/vulnerability/6a3a573e-f9f2-45ec-9156-332cc551fc7e • CWE-1236: Improper Neutralization of Formula Elements in a CSV File •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 1CVE-2022-2239 – Request a Quote < 2.3.9 - Admin+ Stored Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2022-2239
The Request a Quote WordPress plugin before 2.3.9 does not sanitise and escape some of its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed. El plugin Request a Quote de WordPress versiones hasta 2.3.7, no sanea y escapa de algunos de sus parámetros, permitiendo a usuarios con altos privilegios, como los administradores, llevar a cabo ataques de tipo Cross-Site Scripting incluso cuando la capacidad unfiltered_html está deshabilitada The Request a Quote WordPress plugin through 2.3.7 does not sanitise and escape some of its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed. • https://wpscan.com/vulnerability/42127d96-547f-46cb-95d0-a19a8fe7580e • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 1CVE-2021-24420 – Request a Quote < 2.3.4 - Authenticated Stored XSS
https://notcve.org/view.php?id=CVE-2021-24420
The Request a Quote WordPress plugin before 2.3.4 did not sanitise and escape some of its quote fields when adding/editing a quote as admin, leading to Stored Cross-Site scripting issues when the quote is output in the 'All Quotes" table. El plugin Request a Quote de WordPress versiones anteriores a 2.3.4, no saneaba y escapaba de algunos de sus campos quote cuando se añadía/editaba un quote como administrador, conllevando a problemas de tipo Cross-Site Scripting Almacenado cuando el quote se mostraba en la tabla "All Quotes" • https://wpscan.com/vulnerability/426eafb1-0261-4e7e-8c70-75bf4c476f18 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.8EPSS: 0%CPEs: 1EXPL: 1CVE-2021-24489 – Request a Quote < 2.3.9 - Admin+ Stored Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2021-24489
The Request a Quote WordPress plugin before 2.3.9 does not sanitise, validate or escape some of its settings in the admin dashboard, leading to authenticated Stored Cross-Site Scripting issues even when the unfiltered_html capability is disallowed. El plugin Request a Quote de WordPress versiones anteriores a 2.3.5, no sanea, comprueba o escapa de algunas de sus configuraciones en el panel de administración, conllevando a problemas de tipo Cross-Site Scripting Almacenado y autenticado, incluso cuando la capacidad unfiltered_html no está permitida The Request a Quote WordPress plugin before 2.3.5 does not sanitise, validate or escape some of its settings in the admin dashboard, leading to authenticated Stored Cross-Site Scripting issues even when the unfiltered_html capability is disallowed. • https://wpscan.com/vulnerability/36e8efe8-b29f-4c9e-9dd5-3e317aa43e0c • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •