Gsplugins vulnerabilities
14 vulnerabilities
Known vulnerabilities in Gsplugins products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 10 products.
Products
10- Gs Logo Slider2 vulnerabilities
- Gs Pinterest Portfolio2 vulnerabilities
- Gs Testimonial Slider2 vulnerabilities
- Logo Slider2 vulnerabilities
- Gs Books Showcase1 vulnerabilities
- Gs Filterable Portfolio1 vulnerabilities
- Gs Insever Portfolio1 vulnerabilities
- Gs Portfolio For Envato1 vulnerabilities
- Gs Products Slider1 vulnerabilities
- Woocommerce Brands1 vulnerabilities
CVE-2022-40213gs pluginsgs testimonial slider (wordpress plugin)+2
EPSS score0.52%
Multiple Authenticated (contributor+) Stored Cross-Site Scripting (XSS) vulnerabilities in GS Testimonial Slider plugin <= 1.9.6 at WordPress.CVE-2022-4624gspluginsgs_logo_slider+2EPSS score0.47%
The GS Logo Slider WordPress plugin before 3.3.8 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.CVE-2022-35882gs pluginsgs testimonial slider (wordpress plugin)+2EPSS score0.59%
Authenticated (author or higher user role) Stored Cross-Site Scripting (XSS) vulnerability in GS Plugins GS Testimonial Slider plugin <= 1.9.5 at WordPress.CVE-2024-11746gspluginswoocommerce_brands+2EPSS score0.38%
The Discover the Best Woocommerce Product Brands Plugin for WordPress – Woocommerce Brands Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'product_brand' shortcode in all versions up to, and including, 1.3.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.CVE-2024-11453gspluginsgs_pinterest_portfolio+2EPSS score0.29%
The WordPress Pinterest Plugin – Make a Popup, User Profile, Masonry and Gallery Layout plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'gs_pin_widget' shortcode in all versions up to, and including, 1.8.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.CVE-2024-9233gspluginslogo_slider+2EPSS score0.19%
The Logo Slider WordPress plugin before 3.7.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attackCVE-2024-7716gspluginsgs_logo_slider+2EPSS score0.35%
The Logo Slider WordPress plugin before 3.6.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).CVE-2024-30192gs pluginsgs pins for pinterest+2EPSS score0.27%
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GS Plugins GS Pins for Pinterest allows Stored XSS.This issue affects GS Pins for Pinterest: from n/a through 1.8.2.CVE-2023-51530gs pluginslogo slider – logo showcase, logo carousel, logo gallery and client logo presentation+2EPSS score0.24%
Cross-Site Request Forgery (CSRF) vulnerability in GS Plugins Logo Slider – Logo Showcase, Logo Carousel, Logo Gallery and Client Logo Presentation.This issue affects Logo Slider – Logo Showcase, Logo Carousel, Logo Gallery and Client Logo Presentation: from n/a through 3.5.1.CVE-2023-0541gspluginsgs_books_showcase+2EPSS score0.61%
The GS Books Showcase WordPress plugin before 1.3.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.CVE-2023-0559gspluginsgs_portfolio_for_envato+2EPSS score0.46%
The GS Portfolio for Envato WordPress plugin before 1.4.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedded, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacksCVE-2023-0492gspluginsgs_products_slider+2EPSS score0.46%
The GS Products Slider for WooCommerce WordPress plugin before 1.5.9 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacksCVE-2023-0539gspluginsgs_insever_portfolio+2EPSS score0.53%
The GS Insever Portfolio WordPress plugin before 1.4.5 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.CVE-2023-0540gspluginsgs_filterable_portfolio+2EPSS score0.46%
The GS Filterable Portfolio WordPress plugin before 1.6.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.