Wordpress Plugin - vulnerabilities (CVEs)

13 CVEs in 11 products, 0 in the last 30 days, newest from 2024-09-17.

Products

Newest CVEs of Wordpress Plugin

CVE-2024-8051 - CVSS 5.7 (medium), 2024-09-17: The Special Feed Items WordPress plugin through 1.0.1 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could…
CVE-2024-8044 - CVSS 6.5 (medium), 2024-09-17: The infolinks Ad Wrap WordPress plugin through 1.0.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a…
CVE-2024-8043 - CVSS 5.7 (medium), 2024-09-17: The Vikinghammer Tweet WordPress plugin through 0.2.4 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could…
CVE-2024-6244 - CVSS 8.8 (high), 2024-07-22: The PZ Frontend Manager WordPress plugin before 1.0.6 does not have CSRF checks in some places, which could allow attackers to make logged in users perform…
CVE-2024-6073 - CVSS 6.1 (medium), 2024-07-15: The wp-cart-for-digital-products WordPress plugin before 8.5.5 does not sanitise and escape a parameter before outputting it back in the page, leading to a…
CVE-2024-6072 - CVSS 6.1 (medium), 2024-07-15: The wp-cart-for-digital-products WordPress plugin before 8.5.5 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an…
CVE-2024-5473 - CVSS 4 (medium), 2024-06-26: The Simple Photoswipe WordPress plugin through 0.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to…
CVE-2024-5475 - CVSS 5.4 (medium), 2024-06-20: The Responsive video embed WordPress plugin before 0.5.1 does not validate and escape some of its shortcode attributes before outputting them back in a…
CVE-2024-3972 - CVSS 5.7 (medium), 2024-06-14: The Similarity WordPress plugin through 3.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow…
CVE-2024-2907 - CVSS 6.8 (medium), 2024-04-25: The AGCA WordPress plugin before 7.2.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform…
CVE-2024-4014 - CVSS 6.4 (medium), 2024-04-20: The hCaptcha for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's cf7-hcaptcha shortcode in all versions up to,…
CVE-2024-2858 - CVSS 4.8 (medium), 2024-04-15: The Simple Buttons Creator WordPress plugin through 1.04 does not have CSRF checks in some places, which could allow attackers to make logged in users perform…
CVE-2024-2857 - CVSS 6.1 (medium), 2024-04-15: The Simple Buttons Creator WordPress plugin through 1.04 does not have any authorisation as well as CSRF in its add button function, allowing unauthenticated…