Vulnerabilities > Wptaskforce
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2022-05-16 | CVE-2022-1435 | Cross-site Scripting vulnerability in Wptaskforce Track & Trace The WPCargo Track & Trace WordPress plugin before 6.9.5 does not sanitize and escapes some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed. | 3.5 |
| 2022-05-16 | CVE-2022-1436 | Cross-site Scripting vulnerability in Wptaskforce Track & Trace The WPCargo Track & Trace WordPress plugin before 6.9.5 does not sanitise and escape the wpcargo_tracking_number parameter before outputting it back in the page, which could allow attackers to perform reflected Cross-Site Scripting attacks. | 4.3 |
| 2022-03-14 | CVE-2021-25003 | Unrestricted Upload of File with Dangerous Type vulnerability in Wptaskforce Wpcargo Track & Trace The WPCargo Track & Trace WordPress plugin before 6.9.0 contains a file which could allow unauthenticated attackers to write a PHP file anywhere on the web server, leading to RCE | 9.8 |