CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 0CVE-2022-4519 – WP User <= 7.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2022-4519
06 Dec 2022 — The WP User plugin for WordPress is vulnerable to Stored Cross-Site Scripting via its settings parameters in versions up to, and including, 7.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. El c... • https://wordpress.org/plugins/wp-user/#description • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 0CVE-2022-2271 – WP Database Backup < 5.9 - Admin+ Stored Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2022-2271
16 Aug 2022 — The WP Database Backup WordPress plugin before 5.9 does not escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed (for example in multisite setup) El plugin WP Database Backup de WordPress versiones anteriores a 5.9, no escapa a algunas de sus configuraciones, lo que podría permitir a usuarios con altos privilegios, como los administradores, llevar a cabo ataques de tipo Cross-Site Sc... • https://wpscan.com/vulnerability/b064940f-9614-4b7b-b2c4-e79528746833 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 1CVE-2020-7241 – WP Database Backup <= 5.5 - Unauthenticated Information Disclosure
https://notcve.org/view.php?id=CVE-2020-7241
20 Jan 2020 — The WP Database Backup plugin through 5.5 for WordPress stores downloads by default locally in the directory wp-content/uploads/db-backup/. This might allow attackers to read ZIP archives by guessing random ID numbers, guessing date strings with a 2020_{0..1}{0..2}_{0..3}{0..9} format, guessing UNIX timestamps, and making HTTPS requests with the complete guessed URL. El plugin WP Database Backup versiones hasta 5.5 para WordPress, por defecto almacena descargas localmente en el directorio wp-content/uploads... • https://github.com/V1n1v131r4/Exploiting-WP-Database-Backup-WordPress-Plugin/blob/master/README.md • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-330: Use of Insufficiently Random Values •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2019-14949 – WP Database Backup <= 5.1.1 - Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2019-14949
22 Apr 2019 — The wp-database-backup plugin before 5.1.2 for WordPress has XSS. El plugin wp-database-backup anterior a la versión 5.1.2 para WordPress tiene XSS. • https://wordpress.org/plugins/wp-database-backup/#developers • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2016-10874 – WP Database Backup <= 4.3.2 - Cross-Site Request Forgery
https://notcve.org/view.php?id=CVE-2016-10874
04 Aug 2016 — The wp-database-backup plugin before 4.3.3 for WordPress has CSRF. El plugin wp-database-backup anterior a la versión 4.3.3 para WordPress tiene CSRF. • https://wordpress.org/plugins/wp-database-backup/#developers • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2016-10873 – WP Database Backup <= 4.3.2 - Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2016-10873
03 Aug 2016 — The wp-database-backup plugin before 4.3.3 for WordPress has XSS. El plugin wp-database-backup anterior a la versión 4.3.3 para WordPress tiene XSS. • https://wordpress.org/plugins/wp-database-backup/#developers • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2016-10875 – WP Database Backup <= 4.3 - Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2016-10875
01 Aug 2016 — The wp-database-backup plugin before 4.3.1 for WordPress has XSS. El plugin wp-database-backup anterior a la versión 4.3.1 para WordPress tiene XSS. • https://wordpress.org/plugins/wp-database-backup/#developers • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2016-10876 – WP Database Backup <= 4.3 - Cross-Site Request Forgery
https://notcve.org/view.php?id=CVE-2016-10876
08 Apr 2016 — The wp-database-backup plugin before 4.3.1 for WordPress has CSRF. El plugin wp-database-backup anterior a la versión 4.3.1 para WordPress tiene CSRF. • https://wordpress.org/plugins/wp-database-backup/#developers • CWE-352: Cross-Site Request Forgery (CSRF) •