| ID | CVSS | Sažetak | Zadnje ažurirano | Objavljeno |
|---|---|---|---|---|
| CVE-2022-2407 | 4.8 | The WP phpMyAdmin WordPress plugin before 5.2.0.4 does not escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed (for example | 2022-08-25 02:54:00 | 2022-08-22 15:15:00 |
| CVE-2022-2392 | 6.5 | The Lana Downloads Manager WordPress plugin before 1.8.0 is affected by an arbitrary file download vulnerability that can be exploited by users with "Contributor" permissions or higher. | 2022-08-25 02:53:00 | 2022-08-22 15:15:00 |
| CVE-2022-2388 | 6.5 | The WP Coder WordPress plugin before 2.5.3 does not have CSRF check in place when deleting code created by the plugin, which could allow attackers to make a logged in admin delete arbitrary ones via a CSRF attack | 2022-08-25 02:51:00 | 2022-08-22 15:15:00 |
| CVE-2022-2383 | 6.1 | The Feed Them Social WordPress plugin before 3.0.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting | 2022-08-25 02:49:00 | 2022-08-22 15:15:00 |
| CVE-2022-2375 | 5.4 | The WP Sticky Button WordPress plugin before 1.4.1 does not have authorisation and CSRF checks when saving its settings, allowing unauthenticated users to update them. Furthermore, due to the lack of escaping in some of them, it could lead to Stored | 2022-08-25 02:47:00 | 2022-08-22 15:15:00 |
| CVE-2022-2361 | 4.8 | The WP Social Chat WordPress plugin before 6.0.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks. | 2022-08-25 02:46:00 | 2022-08-22 15:15:00 |
| CVE-2022-2275 | 4.3 | The WP Edit Menu WordPress plugin before 1.5.0 does not have CSRF in an AJAX action, which could allow attackers to make a logged in admin delete arbitrary posts/pages from the blog via a CSRF attack | 2022-08-25 02:43:00 | 2022-08-22 15:15:00 |
| CVE-2022-2198 | 4.3 | The WPQA Builder WordPress plugin before 5.7 which is a companion plugin to the Hilmer and Discy , does not check authorization before displaying private messages, allowing any logged in user to read other users private message using the message id, | 2022-08-25 02:43:00 | 2022-08-22 15:15:00 |
| CVE-2022-25812 | 7.2 | The Transposh WordPress Translation WordPress plugin before 1.0.8 does not validate its debug settings, which could allow allowing high privilege users such as admin to perform RCE | 2022-08-25 02:42:00 | 2022-08-22 15:15:00 |
| CVE-2022-2172 | 4.3 | The LinkWorth WordPress plugin before 3.3.4 does not implement nonce checks, which could allow attackers to make a logged in admin change settings via a CSRF attack. | 2022-08-25 02:42:00 | 2022-08-22 15:15:00 |
| ID | CVSS | Sažetak | Zadnje ažurirano | Objavljeno |
|---|
Stranica
/40249
Zapisa po stranici: