Vulmon
Recent Vulnerabilities
Product List
Research Posts
Trends
Blog
About
Contact
Vulmon Alerts
By Relevance
By Risk Score
By Publish Date
wordpress wordpress 2.3.1 vulnerabilities and exploits
(subscribe to this query)
9.8
CVSSv3
CVE-2022-4099
The Joy Of Text Lite WordPress plugin prior to 2.3.1 does not properly sanitise and escape some parameters before using them in SQL statements accessible to unauthenticated users, leading to unauthenticated SQL injection
Getcloudsms Joy Of Text Lite
4.3
CVSSv3
CVE-2021-24781
The Image Source Control WordPress plugin prior to 2.3.1 allows users with a role as low as Contributor to change arbitrary post meta fields of arbitrary posts (even those they should not be able to edit)
Imagesourcecontrol Image Source Control
4.8
CVSSv3
CVE-2022-1299
The Slideshow WordPress plugin up to and including 2.3.1 does not sanitize and escape some of its default slideshow settings, which could allow high-privileged users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
Slideshow Project Slideshow
5.4
CVSSv3
CVE-2022-1209
The Ultimate Member plugin for WordPress is vulnerable to arbitrary redirects due to insufficient validation on supplied URLs in the social fields of the Profile Page, which makes it possible for malicious users to redirect unsuspecting victims in versions up to, and including, 2...
Ultimatemember Ultimate Member
4.8
CVSSv3
CVE-2022-3837
The Uji Countdown WordPress plugin prior to 2.3.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisit...
Wpmanage Uji Countdown
6.1
CVSSv3
CVE-2022-1951
The core plugin for kitestudio WordPress plugin prior to 2.3.1 does not sanitise and escape some parameters before outputting them back in a response of an AJAX action, available to both unauthenticated and authenticated users when a premium theme from the vendor is active, leadi...
Kitestudio Core Plugin For Kitestudio Themes
NA
CVE-2024-0561
The Ultimate Posts Widget WordPress plugin prior to 2.3.1 does not validate and escape some of its Widget options before outputting them back in attributes, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltere...
4.3
CVSSv3
CVE-2023-4792
The Duplicate Post Page Menu & Custom Post Type plugin for WordPress is vulnerable to unauthorized page and post duplication due to a missing capability check on the duplicate_ppmc_post_as_draft function in versions up to, and including, 2.3.1. This makes it possible for auth...
Inqsys Duplicate Post Page Menu & Custom Post Type
5.4
CVSSv3
CVE-2022-4824
The WP Blog and Widgets WordPress plugin prior to 2.3.1 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be u...
Essentialplugin Wp Blog And Widget
5.4
CVSSv3
CVE-2022-4765
The Portfolio for Elementor WordPress plugin prior to 2.3.1 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could ...
Pwrplugins Portfolio For Elementor
CVSSv3
CVSSv2
CVSSv3
VMScore
Recommendations:
type confusion
IMAP
CVE-2024-36103
CVE-2024-28995
CVE-2024-37325
CVE-2024-30078
CVE-2024-30082
SQL injection
CVE-2024-30052
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started
« PREV
2
3
4
5
6
7
8
NEXT »