Pluginus vulnerabilities, page 4

85 vulnerabilities

Known vulnerabilities in Pluginus products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 18 products.

4.3MediumCVE-2023-2555pluginus · wordpress_currency_switcher_professional +2 moreWPCS – WordPress Currency Switcher Professional <= 1.1.9 - Missing Authorization to Custom Drop-Down Currency Switcher CreationThe WPCS – WordPress Currency Switcher Professional plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the create function in versions up to, and including, 1.1.9. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to create a custom drop-down currency switcher.EPSS0.43%10CriticalCVE-2023-51505pluginus · woot +2 moreWordPress Active Products Tables for WooCommerce Plugin <= 1.0.6 is vulnerable to PHP Object InjectionDeserialization of Untrusted Data vulnerability in realmag777 Active Products Tables for WooCommerce. Professional products tables for WooCommerce store.This issue affects Active Products Tables for WooCommerce. Professional products tables for WooCommerce store : from n/a through 1.0.6.EPSS0.65%6.5MediumCVE-2023-51480pluginus · woot +2 moreWordPress Active Products Tables for WooCommerce Plugin <= 1.0.6 is vulnerable to Cross Site Scripting (XSS)Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in realmag777 Active Products Tables for WooCommerce. Professional products tables for WooCommerce store allows Stored XSS.This issue affects Active Products Tables for WooCommerce. Professional products tables for WooCommerce store : from n/a through 1.0.6.EPSS0.31%6.4MediumCVE-2023-51506pluginus · wordpress_currency_switcher +2 moreWordPress WPCS Plugin <= 1.2.0 is vulnerable to Cross Site Scripting (XSS)Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in realmag777 WPCS – WordPress Currency Switcher Professional allows Stored XSS.This issue affects WPCS – WordPress Currency Switcher Professional: from n/a through 1.2.0.EPSS0.27%7.1HighCVE-2023-31218pluginus · wolf_-_wordpress_posts_bulk_editor_and_products_manager_professional +2 moreWordPress WOLF Plugin <= 1.0.6 is vulnerable to CSRF leading to Stored Cross Site Scripting (XSS) vulnerabilityCross-Site Request Forgery (CSRF) leading to Stored Cross-Site Scripting (XSS) vulnerability in realmag777 WOLF – WordPress Posts Bulk Editor and Manager Professional plugin <= 1.0.6 versions.EPSS0.21%4.3MediumCVE-2023-4940pluginus · bear_-_woocommerce_bulk_editor_and_products_manager_professional +2 moreBEAR <= 1.1.3.3 - Cross-Site Request Forgery to Product ManipulationThe BEAR for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.3.3. This is due to missing or incorrect nonce validation on the woobe_bulkoperations_swap function. This makes it possible for unauthenticated attackers to manipulate products via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.EPSS0.32%4.3MediumCVE-2023-4937pluginus · bear_-_woocommerce_bulk_editor_and_products_manager_professional +2 moreBEAR <= 1.1.3.3 - Cross-Site Request Forgery to Product ManipulationThe BEAR for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.3.3. This is due to missing or incorrect nonce validation on the woobe_bulkoperations_apply_default_combination function. This makes it possible for unauthenticated attackers to manipulate products via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.EPSS0.31%4.3MediumCVE-2023-4942pluginus · bear_-_woocommerce_bulk_editor_and_products_manager_professional +2 moreBEAR <= 1.1.3.3 - Cross-Site Request Forgery to Product ManipulationThe BEAR for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.3.3. This is due to missing or incorrect nonce validation on the woobe_bulkoperations_visibility function. This makes it possible for unauthenticated attackers to manipulate products via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.EPSS0.33%5.4MediumCVE-2023-4923pluginus · bear_-_woocommerce_bulk_editor_and_products_manager_professional +2 moreBEAR <= 1.1.3.3 - Cross-Site Request Forgery to Product DeletionThe BEAR for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.3.3. This is due to missing or incorrect nonce validation on the woobe_bulkoperations_delete function. This makes it possible for unauthenticated attackers to delete products via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.EPSS0.33%5.4MediumCVE-2023-4926pluginus · bear_-_woocommerce_bulk_editor_and_products_manager_professional +2 moreBEAR <= 1.1.3.3 - Cross-Site Request Forgery to Product DeletionThe BEAR for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.3.3. This is due to missing or incorrect nonce validation on the woobe_bulk_delete_products function. This makes it possible for unauthenticated attackers to delete products via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.EPSS0.33%4.3MediumCVE-2023-4935pluginus · bear_-_woocommerce_bulk_editor_and_products_manager_professional +2 moreBEAR <= 1.1.3.3 - Cross-Site Request Forgery to Profile CreationThe BEAR for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.3.3. This is due to missing or incorrect nonce validation on the create_profile function. This makes it possible for unauthenticated attackers to create profiles via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.EPSS0.31%4.3MediumCVE-2023-4941pluginus · bear_-_woocommerce_bulk_editor_and_products_manager_professional +2 moreBEAR <= 1.1.3.3 - Missing Authorization to Product ManipulationThe BEAR for WordPress is vulnerable to Missing Authorization in versions up to, and including, 1.1.3.3. This is due to a missing capability check on the woobe_bulkoperations_swap function. This makes it possible for authenticated attackers (subscriber or higher) to manipulate products.EPSS0.57%4.3MediumCVE-2023-4938pluginus · bear_-_woocommerce_bulk_editor_and_products_manager_professional +2 moreBEAR <= 1.1.3.3 - Missing Authorization to Product ManipulationThe BEAR for WordPress is vulnerable to Missing Authorization in versions up to, and including, 1.1.3.3. This is due to a missing capability check on the woobe_bulkoperations_apply_default_combination function. This makes it possible for authenticated attackers (subscriber or higher) to manipulate products.EPSS0.53%8.8HighCVE-2023-4920pluginus · bear_-_woocommerce_bulk_editor_and_products_manager_professional +2 moreBEAR <= 1.1.3.3 - Cross-Site Request Forgery to Stored Cross-Site ScriptingThe BEAR for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.3.3. This is due to missing or incorrect nonce validation on the woobe_save_options function. This makes it possible for unauthenticated attackers to modify the plugin's settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additionally, input sanitization and escaping is insufficient resulting in the possibility of malicious script injection.EPSS0.36%5.4MediumCVE-2023-4924pluginus · bear_-_woocommerce_bulk_editor_and_products_manager_professional +2 moreBEAR <= 1.1.3.3 - Missing Authorization to Product DeletionThe BEAR for WordPress is vulnerable to Missing Authorization in versions up to, and including, 1.1.3.3. This is due to missing capability checks on the woobe_bulkoperations_delete function. This makes it possible for authenticated attackers, with subscriber access or higher, to delete products.EPSS0.32%4.3MediumCVE-2023-4943pluginus · bear_-_woocommerce_bulk_editor_and_products_manager_professional +2 moreBEAR <= 1.1.3.3 - Missing Authorization to Product ManipulationThe BEAR for WordPress is vulnerable to Missing Authorization in versions up to, and including, 1.1.3.3. This is due to a missing capability check on the woobe_bulkoperations_visibility function. This makes it possible for authenticated attackers (subscriber or higher) to manipulate products.EPSS0.57%8.8HighCVE-2023-46152pluginus · wolf_-_wordpress_posts_bulk_editor_and_products_manager_professional +2 moreWordPress WOLF Plugin <= 1.0.7.1 is vulnerable to Cross Site Request Forgery (CSRF)Cross-Site Request Forgery (CSRF) vulnerability in realmag777 WOLF – WordPress Posts Bulk Editor and Manager Professional plugin <= 1.0.7.1 versions.EPSS0.32%5.9MediumCVE-2023-44990pluginus · wolf_-_wordpress_posts_bulk_editor_and_products_manager_professional +2 moreWordPress WOLF Plugin <= 1.0.7.1 is vulnerable to Cross Site Scripting (XSS)Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in realmag777 WOLF – WordPress Posts Bulk Editor and Manager Professional plugin <= 1.0.7.1 versions.EPSS0.33%6.1MediumCVE-2023-28666pluginus · inpost_gallery +1 morepluginus inpost_galleryThe InPost Gallery WordPress plugin, in versions < 2.2.2, is affected by a reflected cross-site scripting vulnerability in the 'imgurl' parameter to the add_inpost_gallery_slide_item action, which can only be triggered by an authenticated user.EPSS0.44%6.1MediumCVE-2023-28664pluginus · wordpress_meta_data_and_taxonomies_filter +1 morepluginus wordpress_meta_data_and_taxonomies_filterThe Meta Data and Taxonomies Filter WordPress plugin, in versions < 1.3.1, is affected by a reflected cross-site scripting vulnerability in the 'tax_name' parameter of the mdf_get_tax_options_in_widget action, which can only be triggered by an authenticated user.EPSS0.44%