196 matches found
WordPress Relevanssi Plugin < 4.22 is vulnerable to Sensitive Data Exposure
Software Relevanssi Type Plugin Vulnerable versions 4.22 Fixed in 4.22 OWASP Top 10 A1: Broken Access Control Classification Sensitive Data Exposure CVE N/A Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 5f9eb9b2e9af Credits N/A Required privilege Unauthenticated Publishe...
CVE-2023-7199
The Relevanssi WordPress plugin before 4.22.0, Relevanssi Premium WordPress plugin before 2.25.0 allows any unauthenticated user to read draft and private posts via a crafted request...
CVE-2023-7199
The Relevanssi WordPress plugin before 4.22.0, Relevanssi Premium WordPress plugin before 2.25.0 allows any unauthenticated user to read draft and private posts via a crafted request...
Cross site request forgery (csrf)
The Relevanssi WordPress plugin before 4.22.0, Relevanssi Premium WordPress plugin before 2.25.0 allows any unauthenticated user to read draft and private posts via a crafted request...
CVE-2023-7199
Summary (CVE-2023-7199): The WordPress plugins Relevanssi (free) and Relevanssi Premium are affected by an unauthenticated disclosure that lets any user read draft and private posts via a crafted request. Affected versions are Relevanssi free < 4.22.0 and Relevanssi Premium
CVE-2023-7199 Relevanssi (Free < 4.22.0, Premium < 2.25.0) - Unauthenticated Private/Draft Post Disclosure
The Relevanssi WordPress plugin before 4.22.0, Relevanssi Premium WordPress plugin before 2.25.0 allows any unauthenticated user to read draft and private posts via a crafted request...
CVE-2023-7199 Relevanssi (Free < 4.22.0, Premium < 2.25.0) - Unauthenticated Private/Draft Post Disclosure
The Relevanssi WordPress plugin before 4.22.0, Relevanssi Premium WordPress plugin before 2.25.0 allows any unauthenticated user to read draft and private posts via a crafted request...
WordPress plugin Relevanssi security vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. The WordPress plugin Relevanssi version...
Relevanssi (Free < 4.22.0, Premium < 2.25.0) - Unauthenticated Private/Draft Post Disclosure
Description The plugin allows any unauthenticated user to read draft and private posts via a crafted request PoC https://example.com/?poststatus=draft https://example.com/?poststatus=private...
Relevanssi (Free < 4.22.0, Premium < 2.25.0) - Unauthenticated Private/Draft Post Disclosure
Description The plugin allows any unauthenticated user to read draft and private posts via a crafted request https://example.com/?poststatus=draft https://example.com/?poststatus=private...
Relevanssi - Subscriber+ Unauthorised AJAX Calls
The plugins do not have authorisation and CSRF checks in some of their AJAX actions, allowing any authenticated users, such as subscriber, to call them. This could disclose information to subscribers, as well as allow them to truncate the index, which will disable the search...
WordPress Relevanssi Premium plugin <= 2.16.4 - Unauthorized AJAX Calls vulnerability
Unauthorized AJAX Calls vulnerability discovered by Jan w Oleju in WordPress Relevanssi Premium plugin versions = 2.16.4. Solution Update the WordPress Relevanssi Premium plugin to the latest available version at least 2.16.5...
WordPress Relevanssi – A Better Search plugin <= 4.14.5 - Unauthorized AJAX Calls vulnerability
Unauthorized AJAX Calls vulnerability discovered by Jan w Oleju in WordPress Relevanssi – A Better Search plugin versions = 4.14.5. Solution Update the WordPress Relevanssi – A Better Search plugin to the latest available version at least 4.14.6...
Relevanssi - Subscriber+ Unauthorised AJAX Calls
The plugins do not have authorisation and CSRF checks in some of their AJAX actions, allowing any authenticated users, such as subscriber, to call them. This could disclose information to subscribers, as well as allow them to truncate the index, which will disable the search PoC...
Cross-site Scripting (XSS) - Stored in msaari/relevanssi
Description Good afternoon. Beginning on 12 October 2021, our XSS catcher started receiving callbacks from a group of sites that are using the Relevanssi plugin for Wordpress. It appears to us that the software is not properly filtering Unsuccessful searches before displaying the information to t...
Relevanssi - A Better Search < 4.14.3 - Unauthenticated Stored Cross-Site Scripting
The plugin does not sanitise and escape user searches before outputting them in the related admin dashboard when the feature is enabled Enable the logging of user query, then was unauthenticated user /?s= The XSS will be triggered when an admin will view the User Searches dashboard at...
Relevanssi - A Better Search < 4.14.3 - Unauthenticated Stored Cross-Site Scripting
The plugin does not sanitise and escape user searches before outputting them in the related admin dashboard when the feature is enabled PoC Enable the logging of user query, then was unauthenticated user /?s= The XSS will be triggered when an admin will view the User Searches dashboard at...
WordPress Relevanssi plugin <= 4.14.2 - Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability
Unauthenticated Stored Cross-Site Scripting XSS vulnerability discovered in WordPress Relevanssi plugin versions = 4.14.2. Solution Update the WordPress Relevanssi plugin to the latest available version at least 4.14.3...
WordPress Relevanssi Premium Plugin SQL Injection Vulnerability
WordPress is a set of blogging platforms developed using the PHP language by the WordPress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A SQL injection vulnerability exists in WordPress Relevanssi Premium plugin versions prior to 1.14.6.1. The...