CVE-2024-12513

The Contests by Rewards Fuel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'RFCONTEST' shortcode in all versions up to, and including, 2.0.65 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-12513 Contests by Rewards Fuel <= 2.0.65 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Contests by Rewards Fuel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'RFCONTEST' shortcode in all versions up to, and including, 2.0.65 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

WordPress plugin Contests by Rewards Fuel 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

WordPress Contests by Rewards Fuel plugin <= 2.0.65 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by zakaria in WordPress Plugin Contests by Rewards Fuel versions = 2.0.65...

CVE-2024-1787

The Contests by Rewards Fuel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'updaterewardsfuelapikey' parameter in all versions up to, and including, 2.0.64 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...

CVE-2024-1787 Contests by Rewards Fuel <= 2.0.64 - Authenticated (Contributor+) Stored Cross-Site Scripting via update_rewards_fuel_api_key

The Contests by Rewards Fuel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'updaterewardsfuelapikey' parameter in all versions up to, and including, 2.0.64 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...

CVE-2024-1787

CVE-2024-1787 affects the WordPress plugin “Contests by Rewards Fuel.” The vulnerability is a Stored XSS via the update_rewards_fuel_api_key parameter in all versions up to and including 2.0.64. Exploitation requires contributor-level access or higher (authenticated). The underlying issue is insu...

CVE-2024-1785 Contests by Rewards Fuel <= 2.0.62 - Cross-Site Request Forgery to Stored Cross-Site Scripting

The Contests by Rewards Fuel plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.62. This is due to missing or incorrect nonce validation on the ajaxhandler function. This makes it possible for unauthenticated attackers to update the plugin's...

CVE-2024-1785

CVE-2024-1785 affects the Contests by Rewards Fuel plugin for WordPress. All versions up to 2.0.62 are vulnerable to CSRF due to missing/incorrect nonce validation in ajax_handler(), allowing unauthenticated attackers to update plugin settings and inject malicious JavaScript via forged requests i...

WordPress Contests by Rewards Fuel Plugin <= 2.0.62 is vulnerable to Cross Site Request Forgery (CSRF)

Software Contests by Rewards Fuel Type Plugin Vulnerable versions = 2.0.62 Fixed in 2.0.63 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-1785 Patch priority Low CVSS severity Low 7.1 Developer Claim ownership PSID b25e33b93d9b Credits Sean Bale...

WordPress Contests by Rewards Fuel Plugin <= 2.0.64 is vulnerable to Cross Site Scripting (XSS)

Software Contests by Rewards Fuel Type Plugin Vulnerable versions = 2.0.64 Fixed in 2.0.65 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-1787 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID b373db375895 Credits Sean Bales...

PT-2024-18304 · WordPress · Contests By Rewards Fuel

Name of the Vulnerable Software and Affected Versions: Contests by Rewards Fuel plugin for WordPress versions up to, and including, 2.0.62 Description: The issue is due to missing or incorrect nonce validation on the ajax handler function, making it possible for unauthenticated attackers to updat...