Vulnerabilities
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2024-09-12 | CVE-2024-7766 | SQL Injection vulnerability in Erichamby Adicon Server The Adicon Server WordPress plugin through 1.2 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks | 7.2 |
| 2024-09-12 | CVE-2024-7816 | Cross-site Scripting vulnerability in Adeelraza Gixaw Chat The Gixaw Chat WordPress plugin through 1.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack. | 6.1 |
| 2024-09-12 | CVE-2024-7817 | Cross-Site Request Forgery (CSRF) vulnerability in Michalaugustyniak Misiek Photo Album The Misiek Photo Album WordPress plugin through 1.4.3 does not have CSRF checks in some places, which could allow attackers to make logged in users delete arbitrary albums via a CSRF attack | 6.5 |
| 2024-09-12 | CVE-2024-7818 | Cross-site Scripting vulnerability in Michalaugustyniak Misiek Photo Album The Misiek Photo Album WordPress plugin through 1.4.3 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack. | 6.1 |
| 2024-09-12 | CVE-2024-7820 | Cross-Site Request Forgery (CSRF) vulnerability in Elliot ILC Thickbox The ILC Thickbox WordPress plugin through 1.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack | 6.5 |
| 2024-09-12 | CVE-2024-7822 | Cross-site Scripting vulnerability in Gwycon Quick Code The Quick Code WordPress plugin through 1.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack. | 6.1 |
| 2024-09-12 | CVE-2024-7859 | Cross-Site Request Forgery (CSRF) vulnerability in Visual Sound Project Visual Sound The Visual Sound WordPress plugin through 1.03 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack | 6.5 |
| 2024-09-12 | CVE-2024-7860 | Cross-site Scripting vulnerability in Outtolunchproductions Simple Headline Rotator The Simple Headline Rotator WordPress plugin through 1.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack. | 6.1 |
| 2024-09-12 | CVE-2024-7861 | Cross-site Scripting vulnerability in Michalaugustyniak Misiek Paypal The Misiek Paypal WordPress plugin through 1.1.20090324 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack. | 6.1 |
| 2024-09-12 | CVE-2024-7862 | Cross-Site Request Forgery (CSRF) vulnerability in Kimhuebel Blogintroduction-Wordpress-Plugin The blogintroduction-wordpress-plugin WordPress plugin through 0.3.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack | 6.5 |