CVSS: 5.9EPSS: 0%CPEs: 1EXPL: 0CVE-2023-27452 – WordPress Button Generator – easily Button Builder Plugin <= 2.3.3 is vulnerable to Cross Site Scripting (XSS)
https://notcve.org/view.php?id=CVE-2023-27452
02 Mar 2023 — Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Wow-Company Button Generator – easily Button Builder plugin <= 2.3.3 versions. The Button Generator – easily Button Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 2.3.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with administrator-level access, and above, to inject arbitrary web scripts in pages t... • https://patchstack.com/database/vulnerability/button-generation/wordpress-button-generator-plugin-2-3-3-cross-site-scripting-xss-vulnerability?_s_id=cve • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.2EPSS: 0%CPEs: 1EXPL: 0CVE-2022-29445 – WordPress Popup Box plugin <= 2.1.2 - Authenticated Local File Inclusion (LFI) vulnerability
https://notcve.org/view.php?id=CVE-2022-29445
17 May 2022 — Authenticated (administrator or higher role) Local File Inclusion (LFI) vulnerability in Wow-Company's Popup Box plugin <= 2.1.2 at WordPress. Una vulnerabilidad de inclusión de archivos locales (LFI) autenticada (administrador o rol superior) en el plugin Popup Box de Wow-Company versiones anteriores a 2.1.2 incluyéndola, en WordPress • https://patchstack.com/database/vulnerability/popup-box/wordpress-popup-box-plugin-2-1-2-authenticated-local-file-inclusion-lfi-vulnerability • CWE-98: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') CWE-706: Use of Incorrectly-Resolved Name or Reference •
CVSS: 7.2EPSS: 0%CPEs: 1EXPL: 0CVE-2022-29448 – WordPress Herd Effects plugin <= 5.2 - Local File Inclusion (LFI) vulnerability
https://notcve.org/view.php?id=CVE-2022-29448
16 May 2022 — Authenticated (admin or higher user role) Local File Inclusion (LFI) vulnerability in Wow-Company's Herd Effects plugin <= 5.2 at WordPress. Una vulnerabilidad de Inclusión de Archivos Locales (LFI) autenticado (rol de administrador o usuario superior) en el plugin Herd Effects de Wow-Company versiones anteriores a 5.2 incluyéndola, en WordPress • https://patchstack.com/database/vulnerability/mwp-herd-effect/wordpress-herd-effects-plugin-5-2-local-file-inclusion-lfi-vulnerability • CWE-98: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') CWE-706: Use of Incorrectly-Resolved Name or Reference •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 1CVE-2022-0313 – Float Menu < 4.3.1 - Arbitrary Menu Deletion via CSRF
https://notcve.org/view.php?id=CVE-2022-0313
24 Jan 2022 — The Float menu WordPress plugin before 4.3.1 does not have CSRF check in place when deleting menu, which could allow attackers to make a logged in admin delete them via a CSRF attack El plugin Float menu de WordPress versiones anteriores a 4.3.1, no presenta una comprobación de tipo CSRF cuando se borra el menú, lo que podría permitir a atacantes hacer que un administrador conectado los borre por medio de un ataque de tipo CSRF • https://plugins.trac.wordpress.org/changeset/2661431 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 1CVE-2021-24580 – Side Menu Lite < 2.2.6 - Authenticated SQL Injection
https://notcve.org/view.php?id=CVE-2021-24580
27 Jul 2021 — The Side Menu Lite WordPress plugin before 2.2.6 does not sanitise user input from the List page in the admin dashboard before using it in SQL statement, leading to a SQL Injection issue El plugin Side Menu Lite de WordPress versiones anteriores a 2.2.6, no sanea la entrada del usuario desde la página de la Lista en el panel de administración antes de usarla en una sentencia SQL, conllevando a un problema de inyección SQL. The Side Menu Lite WordPress plugin before 2.2.6 does not sanitise user input from th... • https://wpscan.com/vulnerability/2faccd1b-4b1c-4b3e-b917-de2d05e860f8 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 7.2EPSS: 0%CPEs: 1EXPL: 2CVE-2021-24521 – Side Menu Lite < 2.2.1 - Authenticated SQL Injection
https://notcve.org/view.php?id=CVE-2021-24521
28 Jun 2021 — The Side Menu Lite – add sticky fixed buttons WordPress plugin before 2.2.1 does not properly sanitize input values from the browser when building an SQL statement. Users with the administrator role or permission to manage this plugin could perform an SQL Injection attack. El plugin de WordPress Side Menu Lite - add sticky fixed buttons versiones anteriores a 2.2.1, no sanea apropiadamente los valores de entrada del navegador cuando se construye una sentencia SQL. Unos usuarios con el rol de administrador o... • https://github.com/pang0lin/CVEproject/blob/main/wordpress_side-menu-lite_sqli.md • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 7.2EPSS: 0%CPEs: 1EXPL: 2CVE-2021-24348 – Side Menu < 3.1.5 - Authenticated (admin+) SQL Injection
https://notcve.org/view.php?id=CVE-2021-24348
27 May 2021 — The menu delete functionality of the Side Menu – add fixed side buttons WordPress plugin before 3.1.5, available to Administrator users takes the did GET parameter and uses it into an SQL statement without proper sanitisation, validation or escaping, therefore leading to a SQL Injection issue La funcionalidad menu delete del plugin Side Menu - add fixed side buttons de WordPress versiones anteriores a 3.1.5, disponible para los usuarios Administradores, toma el parámetro GET y lo usa en una sentencia SQL si... • https://codevigilant.com/disclosure/2021/wp-plugin-side-menu • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •