Vulnerabilities > Badgeos > Badgeos > 1.3.4
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2023-08-31 | CVE-2023-2171 | Unspecified vulnerability in Badgeos The BadgeOS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in versions up to, and including, 3.7.1.6 due to insufficient input sanitization and output escaping on user supplied attributes. | 5.4 |
| 2023-08-31 | CVE-2023-2173 | Unspecified vulnerability in Badgeos The BadgeOS plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 3.7.1.6. | 4.3 |
| 2023-08-31 | CVE-2023-2174 | Missing Authorization vulnerability in Badgeos The BadgeOS plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the delete_badgeos_log_entries function in versions up to, and including, 3.7.1.6. | 4.3 |
| 2023-05-25 | CVE-2022-41987 | Unspecified vulnerability in Badgeos Cross-Site Request Forgery (CSRF) vulnerability in LearningTimes BadgeOS plugin <= 3.7.1.6 versions. | 8.8 |
| 2022-05-09 | CVE-2022-0817 | Unspecified vulnerability in Badgeos The BadgeOS WordPress plugin through 3.7.0 does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action, leading to an SQL Injection exploitable by unauthenticated users | 9.8 |