CVSS: 4.8EPSS: 1%CPEs: 1EXPL: 1CVE-2023-3650 – Bubble Menu < 3.0.5 - Admin+ Stored XSS
https://notcve.org/view.php?id=CVE-2023-3650
17 Jul 2023 — The Bubble Menu WordPress plugin before 3.0.5 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example, in multisite setup). The Bubble Menu plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 3.0.4 due to insufficient input sanitization and output escaping. This makes it possible f... • https://wpscan.com/vulnerability/0a0ecdff-c961-4947-bf7e-bd2392501e33 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.4EPSS: 0%CPEs: 12EXPL: 1CVE-2023-2362 – Multiple Plugins from Wow-Company - Reflected XSS
https://notcve.org/view.php?id=CVE-2023-2362
22 May 2023 — The Float menu WordPress plugin before 5.0.2, Bubble Menu WordPress plugin before 3.0.4, Button Generator WordPress plugin before 2.3.5, Calculator Builder WordPress plugin before 1.5.1, Counter Box WordPress plugin before 1.2.2, Floating Button WordPress plugin before 5.3.1, Herd Effects WordPress plugin before 5.2.2, Popup Box WordPress plugin before 2.2.2, Side Menu Lite WordPress plugin before 4.0.2, Sticky Buttons WordPress plugin before 3.1.1, Wow Skype Buttons WordPress plugin before 4.0.2, WP Coder ... • https://wpscan.com/vulnerability/27e70507-fd68-4915-88cf-0b96ed55208e • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 0CVE-2023-23984 – WordPress Bubble Menu – circle floating menu Plugin <= 3.0.1 is vulnerable to Cross Site Request Forgery (CSRF)
https://notcve.org/view.php?id=CVE-2023-23984
20 Jan 2023 — Cross-Site Request Forgery (CSRF) vulnerability in Wow-Company Bubble Menu – circle floating menu plugin <= 3.0.1 leading to form deletion. The Bubble Menu – circle floating menu plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.0.1. This is due to missing nonce validation in the ~/admin/page-main.php file. This makes it possible for unauthenticated attackers to delete menu items via a forged request granted they can trick a site administrator into performi... • https://patchstack.com/database/vulnerability/bubble-menu/wordpress-bubble-menu-circle-floating-menu-plugin-3-0-1-cross-site-request-forgery-csrf?_s_id=cve • CWE-352: Cross-Site Request Forgery (CSRF) •