Vulnerabilities > Metagauss

DATE CVE VULNERABILITY TITLE RISK
2023-03-20 CVE-2023-0940 Incorrect Authorization vulnerability in Metagauss Profilegrid
The ProfileGrid WordPress plugin before 5.3.1 provides an AJAX endpoint for resetting a user password but does not implement proper authorization.
network
low complexity
metagauss CWE-863
8.8
2023-03-13 CVE-2023-25991 Unspecified vulnerability in Metagauss Registrationmagic
Cross-Site Request Forgery (CSRF) vulnerability in RegistrationMagic plugin <= 5.1.9.2 versions.
network
low complexity
metagauss
8.8
2022-11-28 CVE-2021-25059 Unspecified vulnerability in Metagauss Download Plugin 1.6.1/1.6.2
The Download Plugin WordPress plugin before 2.0.0 does not properly validate a user has the required privileges to access a backup's nonce identifier, which may allow any users with an account on the site (such as subscriber) to download a full copy of the website.
network
low complexity
metagauss
4.3
2022-11-17 CVE-2022-41791 Improper Neutralization of Formula Elements in a CSV File vulnerability in Metagauss Profilegrid
Auth.
network
low complexity
metagauss CWE-1236
8.8
2022-11-14 CVE-2022-3578 Unspecified vulnerability in Metagauss Profilegrid
The ProfileGrid WordPress plugin before 5.1.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting
network
low complexity
metagauss
6.1
2022-03-07 CVE-2022-0420 SQL Injection vulnerability in Metagauss Registrationmagic
The RegistrationMagic WordPress plugin before 5.0.2.2 does not sanitise and escape the rm_form_id parameter before using it in a SQL statement in the Automation admin dashboard, allowing high privilege users to perform SQL injection attacks
network
low complexity
metagauss CWE-89
7.2
2022-02-01 CVE-2021-24648 Cross-site Scripting vulnerability in Metagauss Registrationmagic
The RegistrationMagic WordPress plugin before 5.0.1.9 does not sanitise and escape the rm_search_value parameter before outputting back in an attribute, leading to a Reflected Cross-Site Scripting
network
low complexity
metagauss CWE-79
6.1
2022-01-18 CVE-2022-0232 Cross-site Scripting vulnerability in Metagauss Leadmagic
The User Registration, Login & Landing Pages WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient escaping via the loader_text parameter found in the ~/includes/templates/landing-page.php file which allows attackers with administrative user access to inject arbitrary web scripts, in versions up to and including 1.2.7.
network
low complexity
metagauss CWE-79
4.8
2022-01-18 CVE-2022-0233 Cross-site Scripting vulnerability in Metagauss Profilegrid
The ProfileGrid – User Profiles, Memberships, Groups and Communities WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient escaping via the pm_user_avatar and pm_cover_image parameters found in the ~/admin/class-profile-magic-admin.php file which allows attackers with authenticated user access, such as subscribers, to inject arbitrary web scripts into their profile, in versions up to and including 1.2.7.
network
low complexity
metagauss CWE-79
5.4
2022-01-10 CVE-2021-24862 Unspecified vulnerability in Metagauss Registrationmagic
The RegistrationMagic WordPress plugin before 5.0.1.6 does not escape user input in its rm_chronos_ajax AJAX action before using it in a SQL statement when duplicating tasks in batches, which could lead to a SQL injection issue
network
low complexity
metagauss
7.2