Yasr – Yet Another Stars Rating (WordPress Plugin) Security Vulnerabilities

CVE-2023-44487 vulnerabilities

Vulnerabilities for packages: opentofu, buildkitd, prometheus-bind-exporter, terraform, kots, metacontroller, kpt, nginx-mainline, conftest, external-dns, pulumi-language-dotnet, flux-source-controller, tomcat, amass, istio-envoy, mc, aws-efs-csi-driver, kubernetes-csi-external-attacher,...

GHSA-8R3F-844C-MC37 vulnerabilities

Vulnerabilities for packages: fulcio, filebeat, opentofu, buildkitd, prometheus-bind-exporter, terraform, timoni, kots, gcsfuse, karpenter, metacontroller, kpt, conftest, prometheus-pushgateway, external-dns, pulumi-language-dotnet, rclone, rekor, doppler-kubernetes-operator,...

GHSA-VVPX-J8F3-3W6H vulnerabilities

Vulnerabilities for packages: falco, go, k3d, gke-gcloud-auth-plugin, dynamic-localpv-provisioner, grpcurl, wireguard-go, hey,...

CVE-2024-21626 vulnerabilities

Vulnerabilities for packages: buildkitd, k9s, grype, kots, docker, k3d, runc, kubescape, trivy, zarf, skaffold, telegraf, k3s, kubernetes, kaniko, nvidia-device-plugin, nerdctl, datadog-agent, cadvisor, newrelic-infrastructure-agent, ctop, skopeo, ingress-nginx-controller, zot, syft,...

CVE-2023-45289 vulnerabilities

Vulnerabilities for packages: gops, nri-nginx, filebeat, opentofu, buildkitd, prometheus-bind-exporter, vt-cli, terraform, shfmt, timoni, docker-cli, gcsfuse, dask-gateway, kpt, prometheus-pushgateway, mage, external-dns, sbom-scorecard, doppler-kubernetes-operator, nri-discovery-kubernetes,...

CVE-2023-45288 vulnerabilities

Vulnerabilities for packages: harbor-registry, timoni, docker-cli, minify, mods, sbom-scorecard, dockerize, paranoia, kube-bench, neuvector-sigstore-interface, prometheus-postgres-exporter, spegel, tekton-chains, thanos, nvidia-device-plugin, aactl, cadvisor, tkn, certificate-transparency,...

CVE-2024-24787 vulnerabilities

Vulnerabilities for packages: gops, fulcio, harbor-registry, grafana-rollout-operator, buildkitd, prometheus-bind-exporter, vt-cli, shfmt, timoni, mods, karpenter, metacontroller, dask-gateway, kpt, conftest, mage, external-dns, pulumi-language-dotnet, rclone, rekor, mongo-tools,...

GHSA-5FQ7-4MXC-535H vulnerabilities

Vulnerabilities for packages: gops, fulcio, harbor-registry, grafana-rollout-operator, buildkitd, prometheus-bind-exporter, vt-cli, shfmt, timoni, mods, karpenter, metacontroller, dask-gateway, kpt, conftest, mage, external-dns, pulumi-language-dotnet, rclone, rekor, mongo-tools,...

CVE-2024-24789 vulnerabilities

Vulnerabilities for packages: harbor-registry, timoni, minify, mods, sbom-scorecard, opa, dockerize, paranoia, kube-bench, neuvector-sigstore-interface, wgcf, prometheus-postgres-exporter, spegel, tekton-chains, thanos, nvidia-device-plugin, octo-sts, aactl, kube-vip, cadvisor, age, tkn,...

CVE-2023-45285 vulnerabilities

Vulnerabilities for packages: gops, cortex, cass-operator, wait-for-port, gke-gcloud-auth-plugin, gitlab-logger, prometheus-bind-exporter, render-template, docker-cli, nats, nsc, aws-flb-cloudwatch, sonobuoy, vertical-pod-autoscaler, cilium-envoy, go-bindata, mage, k3d, sbom-scorecard,...

CVE-2023-3978 vulnerabilities

Vulnerabilities for packages: opentofu, buildkitd, prometheus-bind-exporter, terraform, timoni, kots, karpenter, metacontroller, kpt, prometheus-pushgateway, external-dns, pulumi-language-dotnet, flux-source-controller, prometheus-operator, mc, aws-efs-csi-driver, kubernetes-csi-external-attacher,....

CVE-2024-24786 vulnerabilities

Vulnerabilities for packages: fulcio, filebeat, opentofu, buildkitd, prometheus-bind-exporter, terraform, timoni, kots, gcsfuse, karpenter, metacontroller, kpt, conftest, prometheus-pushgateway, external-dns, pulumi-language-dotnet, rclone, rekor, doppler-kubernetes-operator,...

CVE-2024-24784 vulnerabilities

Vulnerabilities for packages: gops, nri-nginx, filebeat, opentofu, buildkitd, prometheus-bind-exporter, vt-cli, terraform, shfmt, timoni, docker-cli, gcsfuse, dask-gateway, kpt, prometheus-pushgateway, mage, external-dns, sbom-scorecard, doppler-kubernetes-operator, nri-discovery-kubernetes,...

GHSA-RR6R-CFGF-GC6H vulnerabilities

Vulnerabilities for packages: gops, nri-nginx, filebeat, opentofu, buildkitd, prometheus-bind-exporter, vt-cli, terraform, shfmt, timoni, docker-cli, gcsfuse, dask-gateway, kpt, prometheus-pushgateway, mage, external-dns, sbom-scorecard, doppler-kubernetes-operator, nri-discovery-kubernetes,...

CVE-2024-35255 vulnerabilities

Vulnerabilities for packages: cortex, fulcio, filebeat, harbor-registry, buildkitd, grafana, kyverno, step, terragrunt, cosign, external-secrets-operator, grafana-mimir, loki, tekton-pipelines, tempo, spire-server, external-dns, rclone, rekor, flux-source-controller, kubescape,...

GHSA-M5VV-6R4H-3VJ9 vulnerabilities

Vulnerabilities for packages: cortex, fulcio, filebeat, harbor-registry, buildkitd, grafana, kyverno, step, terragrunt, cosign, external-secrets-operator, grafana-mimir, loki, tekton-pipelines, tempo, spire-server, external-dns, rclone, rekor, flux-source-controller, kubescape,...

CVE-2022-41723 vulnerabilities

Vulnerabilities for packages: falco, go, k3d, gke-gcloud-auth-plugin, dynamic-localpv-provisioner, grpcurl, wireguard-go, hey,...

GHSA-4V7X-PQXF-CX7M vulnerabilities

Vulnerabilities for packages: harbor-registry, timoni, docker-cli, minify, mods, sbom-scorecard, dockerize, paranoia, kube-bench, neuvector-sigstore-interface, prometheus-postgres-exporter, spegel, tekton-chains, thanos, nvidia-device-plugin, aactl, cadvisor, tkn, certificate-transparency,...

CVE-2024-24790 vulnerabilities

Vulnerabilities for packages: harbor-registry, timoni, minify, mods, sbom-scorecard, opa, dockerize, paranoia, kube-bench, neuvector-sigstore-interface, wgcf, prometheus-postgres-exporter, spegel, tekton-chains, thanos, nvidia-device-plugin, octo-sts, aactl, kube-vip, cadvisor, age, tkn,...

CVE-2023-39325 vulnerabilities

Vulnerabilities for packages: opentofu, buildkitd, prometheus-bind-exporter, terraform, timoni, kots, karpenter, metacontroller, kpt, prometheus-pushgateway, external-dns, pulumi-language-dotnet, flux-source-controller, prometheus-operator, amass, mc, aws-efs-csi-driver,...

GHSA-3Q2C-PVP5-3CQP vulnerabilities

Vulnerabilities for packages: gops, nri-nginx, filebeat, opentofu, buildkitd, prometheus-bind-exporter, vt-cli, terraform, shfmt, timoni, docker-cli, gcsfuse, dask-gateway, kpt, prometheus-pushgateway, mage, external-dns, sbom-scorecard, doppler-kubernetes-operator, nri-discovery-kubernetes,...

GHSA-J6M3-GC37-6R6Q vulnerabilities

Vulnerabilities for packages: gops, nri-nginx, filebeat, opentofu, buildkitd, prometheus-bind-exporter, vt-cli, terraform, shfmt, timoni, docker-cli, gcsfuse, dask-gateway, kpt, prometheus-pushgateway, mage, external-dns, sbom-scorecard, doppler-kubernetes-operator, nri-discovery-kubernetes,...

GHSA-FGQ5-Q76C-GX78 vulnerabilities

Vulnerabilities for packages: gops, nri-nginx, filebeat, opentofu, buildkitd, prometheus-bind-exporter, vt-cli, terraform, shfmt, timoni, docker-cli, gcsfuse, dask-gateway, kpt, prometheus-pushgateway, mage, external-dns, sbom-scorecard, doppler-kubernetes-operator, nri-discovery-kubernetes,...

GHSA-2JWV-JMQ4-4J3R vulnerabilities

Vulnerabilities for packages: gops, fulcio, harbor-registry, grafana-rollout-operator, buildkitd, prometheus-bind-exporter, vt-cli, shfmt, timoni, mods, karpenter, metacontroller, dask-gateway, kpt, conftest, mage, external-dns, pulumi-language-dotnet, rclone, rekor, mongo-tools,...

GHSA-M425-MQ94-257G vulnerabilities

Vulnerabilities for packages: cortex, buildkitd, oauth2-proxy, pulumi-language-java, cosign, terraform, weaviate, grype, pulumi-language-yaml, kots, node-problem-detector, cilium-envoy, kubernetes-csi-node-driver-registrar, calico, conftest, kubevela, external-dns, dex, k3d, neuvector-agent,...

GHSA-QPPJ-FM5R-HXR3 vulnerabilities

Vulnerabilities for packages: opentofu, buildkitd, prometheus-bind-exporter, terraform, kots, metacontroller, kpt, nginx-mainline, conftest, external-dns, pulumi-language-dotnet, flux-source-controller, tomcat, amass, istio-envoy, mc, aws-efs-csi-driver, kubernetes-csi-external-attacher,...

CVE-2024-24783 vulnerabilities

Vulnerabilities for packages: gops, nri-nginx, filebeat, opentofu, buildkitd, prometheus-bind-exporter, vt-cli, terraform, shfmt, timoni, docker-cli, gcsfuse, dask-gateway, kpt, prometheus-pushgateway, mage, external-dns, sbom-scorecard, doppler-kubernetes-operator, nri-discovery-kubernetes,...

CVE-2024-24785 vulnerabilities

Vulnerabilities for packages: gops, nri-nginx, filebeat, opentofu, buildkitd, prometheus-bind-exporter, vt-cli, terraform, shfmt, timoni, docker-cli, gcsfuse, dask-gateway, kpt, prometheus-pushgateway, mage, external-dns, sbom-scorecard, doppler-kubernetes-operator, nri-discovery-kubernetes,...

GHSA-32CH-6X54-Q4H9 vulnerabilities

Vulnerabilities for packages: gops, nri-nginx, filebeat, opentofu, buildkitd, prometheus-bind-exporter, vt-cli, terraform, shfmt, timoni, docker-cli, gcsfuse, dask-gateway, kpt, prometheus-pushgateway, mage, external-dns, sbom-scorecard, doppler-kubernetes-operator, nri-discovery-kubernetes,...

GHSA-49GW-VXVF-FC2G vulnerabilities

Vulnerabilities for packages: harbor-registry, timoni, minify, mods, sbom-scorecard, opa, dockerize, paranoia, kube-bench, neuvector-sigstore-interface, wgcf, prometheus-postgres-exporter, spegel, tekton-chains, thanos, nvidia-device-plugin, octo-sts, aactl, kube-vip, cadvisor, age, tkn,...

CVE-2023-39326 vulnerabilities

Vulnerabilities for packages: gops, cortex, cass-operator, wait-for-port, gke-gcloud-auth-plugin, gitlab-logger, prometheus-bind-exporter, render-template, docker-cli, nats, nsc, aws-flb-cloudwatch, sonobuoy, vertical-pod-autoscaler, cilium-envoy, go-bindata, mage, k3d, sbom-scorecard,...

GHSA-5F94-VHJQ-RPG8 vulnerabilities

Vulnerabilities for packages: gops, cortex, cass-operator, wait-for-port, gke-gcloud-auth-plugin, gitlab-logger, prometheus-bind-exporter, render-template, docker-cli, nats, nsc, aws-flb-cloudwatch, sonobuoy, vertical-pod-autoscaler, cilium-envoy, go-bindata, mage, k3d, sbom-scorecard,...

GHSA-9F76-WG39-X86H vulnerabilities

Vulnerabilities for packages: gops, cortex, cass-operator, wait-for-port, gke-gcloud-auth-plugin, gitlab-logger, prometheus-bind-exporter, render-template, docker-cli, nats, nsc, aws-flb-cloudwatch, sonobuoy, vertical-pod-autoscaler, cilium-envoy, go-bindata, mage, k3d, sbom-scorecard,...

GHSA-2WRH-6PVC-2JM9 vulnerabilities

Vulnerabilities for packages: opentofu, buildkitd, prometheus-bind-exporter, terraform, timoni, kots, karpenter, metacontroller, kpt, prometheus-pushgateway, external-dns, pulumi-language-dotnet, flux-source-controller, prometheus-operator, mc, aws-efs-csi-driver, kubernetes-csi-external-attacher,....

GHSA-4374-P667-P6C8 vulnerabilities

Vulnerabilities for packages: opentofu, buildkitd, prometheus-bind-exporter, terraform, timoni, kots, karpenter, metacontroller, kpt, prometheus-pushgateway, external-dns, pulumi-language-dotnet, flux-source-controller, prometheus-operator, amass, mc, aws-efs-csi-driver,...

CVE-2024-24788 vulnerabilities

Vulnerabilities for packages: gops, fulcio, harbor-registry, grafana-rollout-operator, buildkitd, prometheus-bind-exporter, vt-cli, shfmt, timoni, mods, karpenter, metacontroller, dask-gateway, kpt, conftest, mage, external-dns, pulumi-language-dotnet, rclone, rekor, mongo-tools,...

GHSA-236W-P7WF-5PH8 vulnerabilities

Vulnerabilities for packages: harbor-registry, timoni, minify, mods, sbom-scorecard, opa, dockerize, paranoia, kube-bench, neuvector-sigstore-interface, wgcf, prometheus-postgres-exporter, spegel, tekton-chains, thanos, nvidia-device-plugin, octo-sts, aactl, kube-vip, cadvisor, age, tkn,...

CVE-2023-45290 vulnerabilities

Vulnerabilities for packages: gops, nri-nginx, filebeat, opentofu, buildkitd, prometheus-bind-exporter, vt-cli, terraform, shfmt, timoni, docker-cli, gcsfuse, dask-gateway, kpt, prometheus-pushgateway, mage, external-dns, sbom-scorecard, doppler-kubernetes-operator, nri-discovery-kubernetes,...

GHSA-XR7R-F8XQ-VFVV vulnerabilities

Vulnerabilities for packages: buildkitd, k9s, grype, kots, docker, k3d, runc, kubescape, trivy, zarf, skaffold, telegraf, k3s, kubernetes, kaniko, nvidia-device-plugin, nerdctl, datadog-agent, cadvisor, newrelic-infrastructure-agent, ctop, skopeo, ingress-nginx-controller, zot, syft,...

CVE-2024-2386

The WordPress Plugin for Google Maps – WP MAPS plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter of the 'put_wpgm' shortcode in all versions up to, and including, 4.6.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the...

CVE-2024-2386

The WordPress Plugin for Google Maps – WP MAPS plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter of the 'put_wpgm' shortcode in all versions up to, and including, 4.6.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the...

CVE-2024-2386 WordPress Plugin for Google Maps – WP MAPS <= 4.6.1 - Authenticated (Contributor+) SQL Injection

The WordPress Plugin for Google Maps – WP MAPS plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter of the 'put_wpgm' shortcode in all versions up to, and including, 4.6.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the...

CVE-2023-4017

The Goya theme for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘attra-color’, 'attra-size', and 'product-cata' parameters in versions up to, and including, 1.0.8.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

CVE-2023-4017

The Goya theme for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘attra-color’, 'attra-size', and 'product-cata' parameters in versions up to, and including, 1.0.8.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

CVE-2023-4017 Goya <= 1.0.8.7 - Unauthenticated Reflected Cross-Site Scripting via Multiple Parameters

The Goya theme for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘attra-color’, 'attra-size', and 'product-cata' parameters in versions up to, and including, 1.0.8.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

CVE-2023-4017 Goya <= 1.0.8.7 - Unauthenticated Reflected Cross-Site Scripting via Multiple Parameters

The Goya theme for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘attra-color’, 'attra-size', and 'product-cata' parameters in versions up to, and including, 1.0.8.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

CVE-2024-5819

The Gutenberg Blocks with AI by Kadence WP – Page Builder Features plugin for WordPress is vulnerable to DOM-based Stored Cross-Site Scripting via HTML data attributes in all versions up to, and including, 3.2.45 due to insufficient input sanitization and output escaping on user supplied...

CVE-2024-5819

The Gutenberg Blocks with AI by Kadence WP – Page Builder Features plugin for WordPress is vulnerable to DOM-based Stored Cross-Site Scripting via HTML data attributes in all versions up to, and including, 3.2.45 due to insufficient input sanitization and output escaping on user supplied...

CVE-2024-5819 Gutenberg Blocks with AI by Kadence WP – Page Builder Features <= 3.2.45 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via HTML Data Attributes

The Gutenberg Blocks with AI by Kadence WP – Page Builder Features plugin for WordPress is vulnerable to DOM-based Stored Cross-Site Scripting via HTML data attributes in all versions up to, and including, 3.2.45 due to insufficient input sanitization and output escaping on user supplied...

CVE-2024-5819 Gutenberg Blocks with AI by Kadence WP – Page Builder Features <= 3.2.45 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via HTML Data Attributes

The Gutenberg Blocks with AI by Kadence WP – Page Builder Features plugin for WordPress is vulnerable to DOM-based Stored Cross-Site Scripting via HTML data attributes in all versions up to, and including, 3.2.45 due to insufficient input sanitization and output escaping on user supplied...