CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2024-33589 – WordPress KB Support plugin <= 1.6.0 - Broken Access Control vulnerability
https://notcve.org/view.php?id=CVE-2024-33589
Missing Authorization vulnerability in WPOmnia KB Support.This issue affects KB Support: from n/a through 1.6.0. Vulnerabilidad de autorización faltante en WPOmnia KB Support. Este problema afecta a KB Support: desde n/a hasta 1.6.0. The KB Support plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the kbs_ajax_display_ticket_notes and kbs_ajax_display_ticket_replies function in versions up to, and including, 1.6.0. This makes it possible for authenticated attackers, with subscriber-level access and above, to view ticket notes and replies. • https://patchstack.com/database/vulnerability/kb-support/wordpress-kb-support-plugin-1-6-0-broken-access-control-vulnerability?_s_id=cve • CWE-862: Missing Authorization •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0CVE-2023-37890 – WordPress KB Support Plugin <= 1.5.88 is vulnerable to Broken Access Control
https://notcve.org/view.php?id=CVE-2023-37890
Missing Authorization vulnerability in WPOmnia KB Support – WordPress Help Desk and Knowledge Base allows Accessing Functionality Not Properly Constrained by ACLs. Users with a role as low as a subscriber can view other customers.This issue affects KB Support – WordPress Help Desk and Knowledge Base: from n/a through 1.5.88. Vulnerabilidad de autorización faltante en WPOmnia KB Support – WordPress Help Desk and Knowledge Base permite Accessing Functionality Not Properly Constrained by ACLs. Los usuarios con un rol tan bajo como suscriptor pueden ver a otros clientes. Este problema afecta a KB Support – WordPress Help Desk and Knowledge Base: desde n/a hasta 1.5.88. • https://patchstack.com/database/vulnerability/kb-support/wordpress-kb-support-wordpress-help-desk-plugin-1-5-88-sensitive-data-exposure-vulnerability?_s_id=cve • CWE-862: Missing Authorization •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2023-25983 – WordPress KB Support Plugin <= 1.5.84 is vulnerable to CSV Injection
https://notcve.org/view.php?id=CVE-2023-25983
Improper Neutralization of Formula Elements in a CSV File vulnerability in WPOmnia KB Support.This issue affects KB Support: from n/a through 1.5.84. Neutralización inadecuada de elementos de fórmula en una vulnerabilidad de CSV File en WPOmnia KB Support. Este problema afecta a KB Support: desde n/a hasta 1.5.84. The KB Support plugin for WordPress is vulnerable to CSV Injection in versions up to, and including, KB Support. This allows subscriber-level attackers to embed untrusted input into exported CSV files, which can result in code execution when these files are downloaded and opened on a local system with a vulnerable configuration. • https://patchstack.com/database/vulnerability/kb-support/wordpress-kb-support-wordpress-help-desk-plugin-1-5-84-csv-injection-vulnerability?_s_id=cve • CWE-1236: Improper Neutralization of Formula Elements in a CSV File •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2022-27852 – WordPress KB Support plugin <= 1.5.5 - Multiple Unauth. Stored Cross-Site Scripting (XSS) vulnerabilities
https://notcve.org/view.php?id=CVE-2022-27852
Multiple Unauthenticated Stored Cross-Site Scripting (XSS) vulnerabilities in KB Support (WordPress plugin) <= 1.5.5 versions. Múltiples vulnerabilidades de tipo Cross-Site Scripting (XSS) almacenadas sin autenticación en KB Support (plugin de WordPress) versiones anteriores a 1.5.5 incluyéndola The plugin KB Support – WordPress Help Desk versions up to 1.5.5 are vulnerable to Cross-Site Scripting. The vulnerabilities allow unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. • https://patchstack.com/database/vulnerability/kb-support/wordpress-kb-support-wordpress-help-desk-plugin-1-5-5-multiple-unauthenticated-stored-cross-site-scripting-xss-vulnerabilities?_s_id=cve • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •