Vulnerabilities > Tipsandtricks HQ
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2024-01-27 | CVE-2023-6497 | Cross-site Scripting vulnerability in Tipsandtricks-Hq Wordpress Simple Paypal Shopping Cart The WordPress Simple Shopping Cart plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the automatic redirect URL setting in all versions up to and including 4.7.1 due to insufficient input sanitization and output escaping. | 4.8 |
| 2023-11-03 | CVE-2022-47588 | SQL Injection vulnerability in Tipsandtricks-Hq Simple Photo Gallery Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Tips and Tricks HQ, Peter Petreski Simple Photo Gallery simple-photo-gallery allows SQL Injection.This issue affects Simple Photo Gallery: from n/a through v1.8.1. | 9.8 |
| 2023-05-12 | CVE-2023-22685 | Cross-site Scripting vulnerability in Tipsandtricks-Hq Category Specific RSS Feed Subscription Auth. | 4.8 |
| 2023-05-03 | CVE-2023-22691 | Cross-Site Request Forgery (CSRF) vulnerability in Tipsandtricks-Hq Category Specific RSS Feed Subscription Cross-Site Request Forgery (CSRF) vulnerability in Tips and Tricks HQ, Ruhul Amin Category Specific RSS feed Subscription plugin <= v2.1 versions. | 8.8 |
| 2023-03-17 | CVE-2023-1469 | Unspecified vulnerability in Tipsandtricks-Hq WP Express Checkout The WP Express Checkout plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘pec_coupon[code]’ parameter in versions up to, and including, 2.2.8 due to insufficient input sanitization and output escaping. | 4.8 |
| 2023-03-16 | CVE-2023-1431 | Unspecified vulnerability in Tipsandtricks-Hq Wordpress Simple Paypal Shopping Cart The WP Simple Shopping Cart plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 4.6.3 due to the plugin saving shopping cart data exports in a publicly accessible location (/wp-content/plugins/wordpress-simple-paypal-shopping-cart/includes/admin/). | 5.3 |
| 2023-02-13 | CVE-2023-0275 | Unspecified vulnerability in Tipsandtricks-Hq Easy Accept Payments for Paypal The Easy Accept Payments for PayPal WordPress plugin before 4.9.10 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. | 5.4 |
| 2023-01-23 | CVE-2022-4542 | Unspecified vulnerability in Tipsandtricks-Hq Compact WP Audio Player The Compact WP Audio Player WordPress plugin before 1.9.8 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins. | 5.4 |
| 2023-01-23 | CVE-2022-4672 | Unspecified vulnerability in Tipsandtricks-Hq Wordpress Simple Paypal Shopping Cart The WordPress Simple Shopping Cart WordPress plugin before 4.6.2 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins. | 5.4 |
| 2023-01-16 | CVE-2022-4465 | Unspecified vulnerability in Tipsandtricks-Hq WP Video Lightbox The WP Video Lightbox WordPress plugin before 1.9.7 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admin. | 5.4 |