Vulnerabilities > Webfactoryltd
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2022-05-30 | CVE-2022-1582 | Cross-site Scripting vulnerability in Webfactoryltd External Links in NEW Window / NEW TAB The External Links in New Window / New Tab WordPress plugin before 1.43 does not properly escape URLs it concatenates to onclick event handlers, which makes Stored Cross-Site Scripting attacks possible. | 6.1 |
| 2022-05-30 | CVE-2022-1583 | Use of Web Link to Untrusted Target with window.opener Access vulnerability in Webfactoryltd External Links in NEW Window / NEW TAB The External Links in New Window / New Tab WordPress plugin before 1.43 does not ensure window.opener is set to "null" when links to external sites are clicked, which may enable tabnabbing attacks to occur. | 6.5 |
| 2021-11-18 | CVE-2021-36908 | Cross-Site Request Forgery (CSRF) vulnerability in Webfactoryltd WP Reset PRO Cross-Site Request Forgery (CSRF) vulnerability in WebFactory Ltd. | 8.8 |
| 2021-11-18 | CVE-2021-36909 | Missing Authorization vulnerability in Webfactoryltd WP Reset PRO Authenticated Database Reset vulnerability in WordPress WP Reset PRO Premium plugin (versions <= 5.98) allows any authenticated user to wipe the entire database regardless of their authorization. | 8.1 |
| 2021-08-23 | CVE-2021-24533 | Cross-site Scripting vulnerability in Webfactoryltd Maintenance The Maintenance WordPress plugin before 4.03 does not sanitise or escape some of its settings, allowing high privilege users such as admin to se Cross-Site Scripting payload in them (even when the unfiltered_html capability is disallowed), which will be triggered in the frontend | 4.8 |
| 2021-07-12 | CVE-2021-24424 | Cross-site Scripting vulnerability in Webfactoryltd WP Reset The WP Reset – Most Advanced WordPress Reset Tool WordPress plugin before 1.90 did not sanitise or escape its extra_data parameter when creating a snapshot via the admin dashboard, leading to an authenticated Stored Cross-Site Scripting issue | 5.4 |
| 2021-03-18 | CVE-2021-24142 | SQL Injection vulnerability in Webfactoryltd 301 Redirects Unvaludated input in the 301 Redirects - Easy Redirect Manager WordPress plugin, versions before 2.51, did not sanitise its "Redirect From" column when importing a CSV file, allowing high privilege users to perform SQL injections. | 7.2 |
| 2020-01-16 | CVE-2020-7048 | Missing Authentication for Critical Function vulnerability in Webfactoryltd WP Database Reset The WordPress plugin, WP Database Reset through 3.1, contains a flaw that allowed any unauthenticated user to reset any table in the database to the initial WordPress set-up state (deleting all site content stored in that table), as demonstrated by a wp-admin/admin-post.php?db-reset-tables[]=comments URI. | 9.1 |
| 2020-01-16 | CVE-2020-7047 | Improper Privilege Management vulnerability in Webfactoryltd WP Database Reset The WordPress plugin, WP Database Reset through 3.1, contains a flaw that gave any authenticated user, with minimal permissions, the ability (with a simple wp-admin/admin.php?db-reset-tables[]=users request) to escalate their privileges to administrator while dropping all other users from the table. | 8.8 |
| 2020-01-09 | CVE-2020-6168 | Missing Authorization vulnerability in Webfactoryltd Minimal Coming Soon & Maintenance Mode A flaw in the WordPress plugin, Minimal Coming Soon & Maintenance Mode through 2.10, allows authenticated users with basic access to enable and disable maintenance-mode settings (impacting the availability and confidentiality of a vulnerable site, along with the integrity of the setting). | 7.6 |