CVSS: 7.2EPSS: 0%CPEs: 2EXPL: 1CVE-2018-1000508 – WP ULike < 3.2 - Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2018-1000508
WP ULike version 2.8.1, 3.1 contains a Cross Site Scripting (XSS) vulnerability in Settings screen that can result in allows unauthorised users to do almost anything an admin can. This attack appear to be exploitable via Admin must visit logs page. This vulnerability appears to have been fixed in 3.2. WP ULike en sus versiones 2.8.1 y 3.1 contiene una vulnerabilidad de Cross Site Scripting (XSS) en la pantalla Settings que puede resultar en que usuarios no autorizados hagan casi cualquier acción que pueda realizar un administrador. El ataque parece ser explotable mediante un administrador que visite una página de registros. • https://advisories.dxw.com/advisories/stored-xss-wp-ulike • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 1CVE-2018-1000511 – WP ULike < 3.2 - Missing Authorization
https://notcve.org/view.php?id=CVE-2018-1000511
WP ULike version 2.8.1, 3.1 contains a Incorrect Access Control vulnerability in AJAX that can result in allows anybody to delete any row in certain tables. This attack appear to be exploitable via Attacker must make AJAX request. This vulnerability appears to have been fixed in 3.2. WP ULike 2.8.1 y 3.1 contiene una vulnerabilidad de control de acceso incorrecto en AJAX que puede resultar en que cualquiera pueda eliminar cualquier fila en determinadas tablas. El ataque parece ser explotable mediante un atacante que realice una petición AJAX. • https://advisories.dxw.com/advisories/wp-ulike-delete-rows • CWE-732: Incorrect Permission Assignment for Critical Resource CWE-862: Missing Authorization •