Vulnerabilities > Premio
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2024-01-11 | CVE-2023-7048 | Cross-Site Request Forgery (CSRF) vulnerability in Premio MY Sticky BAR The My Sticky Bar plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.6.6. | 4.3 |
| 2023-12-20 | CVE-2023-40204 | Unrestricted Upload of File with Dangerous Type vulnerability in Premio Folders Unrestricted Upload of File with Dangerous Type vulnerability in Premio Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager.This issue affects Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager: from n/a through 2.9.2. | 7.2 |
| 2023-11-22 | CVE-2023-47759 | Cross-site Scripting vulnerability in Premio Chaty Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Premio Chaty plugin <= 3.1.2 versions. | 4.8 |
| 2023-11-20 | CVE-2023-5509 | Incorrect Authorization vulnerability in Premio Mystickymenu The myStickymenu WordPress plugin before 2.6.5 does not adequately authorize some ajax calls, allowing any logged-in user to perform the actions. | 5.4 |
| 2023-08-30 | CVE-2023-25019 | Cross-site Scripting vulnerability in Premio Chaty Unauth. | 6.1 |
| 2023-07-24 | CVE-2023-3248 | Unspecified vulnerability in Premio MY Sticky Elements The All-in-one Floating Contact Form WordPress plugin before 2.1.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) | 4.8 |
| 2023-07-17 | CVE-2023-3245 | Cross-site Scripting vulnerability in Premio Chaty The Floating Chat Widget WordPress plugin before 3.1.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) | 4.8 |
| 2023-02-27 | CVE-2023-0487 | SQL Injection vulnerability in Premio MY Sticky Elements The My Sticky Elements WordPress plugin before 2.0.9 does not properly sanitise and escape a parameter before using it in a SQL statement when deleting messages, leading to a SQL injection exploitable by high privilege users such as admin | 7.2 |
| 2022-12-05 | CVE-2022-3858 | Unspecified vulnerability in Premio Chaty The Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line, WeChat, Email, SMS, Call Button WordPress plugin before 3.0.3 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as admin. | 7.2 |
| 2022-04-11 | CVE-2021-36846 | Cross-site Scripting vulnerability in Premio Chaty Authenticated (admin or higher user role) Stored Cross-Site Scripting (XSS) vulnerability in Premio Chaty (WordPress plugin) <= 2.8.3 | 3.5 |