Sitemap Project vulnerabilities
3 vulnerabilities
Known vulnerabilities in Sitemap Project products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 1 product.
Products
1- Sitemap3 vulnerabilities
HighCVE-2021-24192sitemap_project · sitemap +2 moreTree Sitemap < 2.9 - Arbitrary Plugin Installation/Activation via Low Privilege UserLow privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the Tree Sitemap WordPress plugin before 2.9, to install any plugin (including a specific version) from the WordPress repository, as well as activate arbitrary plugin from then blog, which helps attackers install vulnerable plugins and could lead to more critical vulnerabilities like RCE.EPSS1.32%HighCVE-2022-0952sitemap_project · sitemap +2 moreSitemap by click5 < 1.0.36 - Unauthenticated Arbitrary Options UpdateThe Sitemap by click5 WordPress plugin before 1.0.36 does not have authorisation and CSRF checks when updating options via a REST endpoint, and does not ensure that the option to be updated belongs to the plugin. As a result, unauthenticated attackers could change arbitrary blog options, such as the users_can_register and default_role, allowing them to create a new admin account and take over the blog.EPSS11.42%MediumCVE-2022-4545sitemap_project · sitemap +2 moreSitemap < 4.4 - Contributor+ Stored XSSThe Sitemap WordPress plugin before 4.4 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.EPSS0.47%