Vulnerabilities > Etoilewebdesign
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2023-08-31 | CVE-2023-4471 | Unspecified vulnerability in Etoilewebdesign Order Tracking 3.3.6 The Order Tracking Pro plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the start_date and end_date parameters in versions up to, and including, 3.3.6 due to insufficient input sanitization and output escaping. | 6.1 |
| 2023-08-31 | CVE-2023-4500 | Unspecified vulnerability in Etoilewebdesign Order Tracking 3.3.6 The Order Tracking Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the order status parameter in versions up to, and including, 3.3.6 due to insufficient input sanitization and output escaping. | 4.8 |
| 2023-07-17 | CVE-2023-34005 | Cross-Site Request Forgery (CSRF) vulnerability in Etoilewebdesign Front END Users Cross-Site Request Forgery (CSRF) vulnerability in Etoile Web Design Front End Users plugin <= 3.2.24 versions. | 8.8 |
| 2023-06-27 | CVE-2023-2711 | Unspecified vulnerability in Etoilewebdesign Ultimate Product Catalog The Ultimate Product Catalog WordPress plugin before 5.2.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) | 4.8 |
| 2023-06-07 | CVE-2020-36726 | Deserialization of Untrusted Data vulnerability in Etoilewebdesign Ultimate Reviews The Ultimate Reviews plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 2.1.32 via deserialization of untrusted input in several vulnerable functions. | 9.8 |
| 2022-02-07 | CVE-2021-24993 | Cross-Site Request Forgery (CSRF) vulnerability in Etoilewebdesign Ultimate Product Catalog The Ultimate Product Catalog WordPress plugin before 5.0.26 does not have authorisation and CSRF checks in some AJAX actions, which could allow any authenticated users, such as subscriber to call them and add arbitrary products, or change the plugin's settings for example | 6.5 |
| 2022-01-28 | CVE-2022-23979 | Cross-site Scripting vulnerability in Etoilewebdesign Ultimate Reviews Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability discovered in Ultimate Reviews WordPress plugin (versions <= 3.0.15). | 3.5 |
| 2022-01-24 | CVE-2021-24968 | Cross-Site Request Forgery (CSRF) vulnerability in Etoilewebdesign Ultimate FAQ The Ultimate FAQ WordPress plugin before 2.1.2 does not have capability and CSRF checks in the ewd_ufaq_welcome_add_faq and ewd_ufaq_welcome_add_faq_page AJAX actions, available to any authenticated users. | 5.7 |
| 2020-08-26 | CVE-2020-24313 | Cross-site Scripting vulnerability in Etoilewebdesign Ultimate Appointment Booking & Scheduling Etoile Web Design Ultimate Appointment Booking & Scheduling WordPress Plugin v1.1.9 and lower does not sanitize the value of the "Appointment_ID" GET parameter before echoing it back out inside an input tag. | 6.1 |
| 2020-01-16 | CVE-2020-7107 | Cross-site Scripting vulnerability in Etoilewebdesign Ultimate FAQ The Ultimate FAQ plugin before 1.8.30 for WordPress allows XSS via Display_FAQ to Shortcodes/DisplayFAQs.php. | 4.3 |