Samdani vulnerabilities
8 vulnerabilities
Known vulnerabilities in Samdani products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 8 products.
Products
8- Team Members – A Wordpress Team Plugin With Gallery, Grid, Carousel, Slider, Table, List, And More2 vulnerabilities
- GS Books Showcase – Display Books In Grid, Slider & More | Library For Wordpress1 vulnerabilities
- GS Brands For Woocommerce1 vulnerabilities
- GS Insever Portfolio1 vulnerabilities
- GS Pinterest Portfolio – Pins Grid, Masonry, User Profile, Popup & Board Widgets1 vulnerabilities
- GS Portfolio – A Plugin For Making Filterable Portfolio Grid, Portfolio Slider And More1 vulnerabilities
- Logo Slider – Logo Showcase, Logo Carousel, Logo Gallery And Client Logo Presentation1 vulnerabilities
- Solid Testimonials – Testimonial Slider, Video Testimonials & Customer Reviews1 vulnerabilities
CVE-2025-2262samdanilogo slider – logo showcase, logo carousel, logo gallery and client logo presentation+1
EPSS score0.47%
The The Logo Slider – Logo Showcase, Logo Carousel, Logo Gallery and Client Logo Presentation plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.7.3. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.CVE-2022-49745starpluginseasy_age_verify+1239EPSS score0.44%
The Freemius SDK, as used by hundreds of WordPress plugin and theme developers, was vulnerable to Cross-Site Request Forgery and Information disclosure due to missing capability checks and nonce protection on the _get_debug_log, _get_db_option, and the _set_db_option functions in versions up to, and including 2.4.2. Any WordPress plugin or theme running a version of Freemius less than 2.4.3 is vulnerable.CVE-2024-13362100pluginsopen_user_map+262EPSS score0.28%
Multiple plugins and/or themes for WordPress are vulnerable to Reflected Cross-Site Scripting via the url parameter in various versions due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.CVE-2024-11746gspluginswoocommerce_brands+2EPSS score0.38%
The Discover the Best Woocommerce Product Brands Plugin for WordPress – Woocommerce Brands Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'product_brand' shortcode in all versions up to, and including, 1.3.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.CVE-2024-11453gspluginsgs_pinterest_portfolio+2EPSS score0.29%
The WordPress Pinterest Plugin – Make a Popup, User Profile, Masonry and Gallery Layout plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'gs_pin_widget' shortcode in all versions up to, and including, 1.8.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.CVE-2024-11766samdanigs books showcase – display books in grid, slider & more | library for wordpress+1EPSS score0.36%
The WordPress Book Plugin for Displaying Books in Grid, Flip, Slider, Popup Layout and more plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'gs_book_showcase' shortcode in all versions up to, and including, 1.3.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.CVE-2024-11765samdanigs portfolio – a plugin for making filterable portfolio grid, portfolio slider and more+1EPSS score0.36%
The WordPress Portfolio Plugin – A Plugin for Making Filterable Portfolio Grid, Portfolio Slider and more plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'gs_portfolio' shortcode in all versions up to, and including, 1.6.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.CVE-2024-12249samdanigs insever portfolio+1EPSS score0.34%
The GS Insever Portfolio plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save_settings() function in all versions up to, and including, 1.4.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update the plugin's CSS settings.