Vulnerabilities > Designwall
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2023-07-12 | CVE-2021-4408 | Unspecified vulnerability in Designwall DW Question & Answer The DW Question & Answer plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.5.8. | 4.3 |
| 2022-08-08 | CVE-2022-2423 | Cross-site Scripting vulnerability in Designwall DW Promobar 1.0.4 The DW Promobar WordPress plugin through 1.0.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed (for example in multisite setup) | 4.8 |
| 2022-04-25 | CVE-2021-24800 | Authorization Bypass Through User-Controlled Key vulnerability in Designwall DW Question & Answer The DW Question & Answer Pro WordPress plugin through 1.3.4 does not check that the comment to edit belongs to the user making the request, allowing any user to edit other comments. | 4.3 |
| 2022-04-25 | CVE-2021-24805 | Cross-Site Request Forgery (CSRF) vulnerability in Designwall DW Question & Answer The DW Question & Answer Pro WordPress plugin through 1.3.4 does not properly check for CSRF in some of its functions, allowing attackers to make logged in users perform unwanted actions, such as update a comment or a question status. | 4.3 |