CVSS: 5.9EPSS: 0%CPEs: 1EXPL: 0CVE-2023-27452 – WordPress Button Generator – easily Button Builder Plugin <= 2.3.3 is vulnerable to Cross Site Scripting (XSS)
https://notcve.org/view.php?id=CVE-2023-27452
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Wow-Company Button Generator – easily Button Builder plugin <= 2.3.3 versions. The Button Generator – easily Button Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 2.3.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with administrator-level access, and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. • https://patchstack.com/database/vulnerability/button-generation/wordpress-button-generator-plugin-2-3-3-cross-site-scripting-xss-vulnerability?_s_id=cve • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.2EPSS: 0%CPEs: 1EXPL: 0CVE-2022-29445 – WordPress Popup Box plugin <= 2.1.2 - Authenticated Local File Inclusion (LFI) vulnerability
https://notcve.org/view.php?id=CVE-2022-29445
Authenticated (administrator or higher role) Local File Inclusion (LFI) vulnerability in Wow-Company's Popup Box plugin <= 2.1.2 at WordPress. Una vulnerabilidad de inclusión de archivos locales (LFI) autenticada (administrador o rol superior) en el plugin Popup Box de Wow-Company versiones anteriores a 2.1.2 incluyéndola, en WordPress • https://patchstack.com/database/vulnerability/popup-box/wordpress-popup-box-plugin-2-1-2-authenticated-local-file-inclusion-lfi-vulnerability https://wordpress.org/plugins/popup-box/#developers • CWE-98: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') CWE-706: Use of Incorrectly-Resolved Name or Reference •
CVSS: 7.2EPSS: 0%CPEs: 1EXPL: 0CVE-2022-29448 – WordPress Herd Effects plugin <= 5.2 - Local File Inclusion (LFI) vulnerability
https://notcve.org/view.php?id=CVE-2022-29448
Authenticated (admin or higher user role) Local File Inclusion (LFI) vulnerability in Wow-Company's Herd Effects plugin <= 5.2 at WordPress. Una vulnerabilidad de Inclusión de Archivos Locales (LFI) autenticado (rol de administrador o usuario superior) en el plugin Herd Effects de Wow-Company versiones anteriores a 5.2 incluyéndola, en WordPress • https://patchstack.com/database/vulnerability/mwp-herd-effect/wordpress-herd-effects-plugin-5-2-local-file-inclusion-lfi-vulnerability https://wordpress.org/plugins/mwp-herd-effect/#developers • CWE-98: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') CWE-706: Use of Incorrectly-Resolved Name or Reference •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 1CVE-2022-0313 – Float Menu < 4.3.1 - Arbitrary Menu Deletion via CSRF
https://notcve.org/view.php?id=CVE-2022-0313
The Float menu WordPress plugin before 4.3.1 does not have CSRF check in place when deleting menu, which could allow attackers to make a logged in admin delete them via a CSRF attack El plugin Float menu de WordPress versiones anteriores a 4.3.1, no presenta una comprobación de tipo CSRF cuando se borra el menú, lo que podría permitir a atacantes hacer que un administrador conectado los borre por medio de un ataque de tipo CSRF • https://plugins.trac.wordpress.org/changeset/2661431 https://wpscan.com/vulnerability/1ce6c8f4-6f4b-4d56-8d11-43355ef32e8c • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 1CVE-2021-24580 – Side Menu Lite < 2.2.6 - Authenticated SQL Injection
https://notcve.org/view.php?id=CVE-2021-24580
The Side Menu Lite WordPress plugin before 2.2.6 does not sanitise user input from the List page in the admin dashboard before using it in SQL statement, leading to a SQL Injection issue El plugin Side Menu Lite de WordPress versiones anteriores a 2.2.6, no sanea la entrada del usuario desde la página de la Lista en el panel de administración antes de usarla en una sentencia SQL, conllevando a un problema de inyección SQL. The Side Menu Lite WordPress plugin before 2.2.6 does not sanitise user input from the List page in the admin dashboard before using it in SQL statement, leading to a SQL Injection issue. • https://wpscan.com/vulnerability/2faccd1b-4b1c-4b3e-b917-de2d05e860f8 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •