CVE-2023-46154

The CVE-2023-46154 entry describes a PHP Object Injection (deserialization) vulnerability in the E2Pdf – Export To Pdf Tool for WordPress plugin. Exploitation requires Administrator privileges and affects versions up to 1.20.18; the issue can lead to arbitrary object injection due to untrusted da...

CVE-2023-46154 WordPress e2pdf Plugin <= 1.20.18 is vulnerable to PHP Object Injection

Deserialization of Untrusted Data vulnerability in E2Pdf.Com E2Pdf – Export To Pdf Tool for WordPress.This issue affects E2Pdf – Export To Pdf Tool for WordPress: from n/a through 1.20.18...

WordPress Plugin E2Pdf Code Issue Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A code issue vulnerability...

CVE-2023-6826

The E2Pdf plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation on the 'importaction' function in versions up to, and including, 1.20.25. This makes it possible for authenticated attackers with a role that the administrator previously granted access...

CVE-2023-6826

The E2Pdf plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation on the 'importaction' function in versions up to, and including, 1.20.25. This makes it possible for authenticated attackers with a role that the administrator previously granted access...

Input validation

The E2Pdf plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation on the 'importaction' function in versions up to, and including, 1.20.25. This makes it possible for authenticated attackers with a role that the administrator previously granted access...

CVE-2023-6826 E2Pdf <= 1.20.25 - Authenticated (Administrator+) Arbitrary File Upload

The E2Pdf plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation on the 'importaction' function in versions up to, and including, 1.20.25. This makes it possible for authenticated attackers with a role that the administrator previously granted access...

CVE-2023-6826 E2Pdf <= 1.20.25 - Authenticated (Administrator+) Arbitrary File Upload

The E2Pdf plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation on the 'importaction' function in versions up to, and including, 1.20.25. This makes it possible for authenticated attackers with a role that the administrator previously granted access...

CVE-2023-6826

CVE-2023-6826 affects the WordPress plugin E2Pdf (Export To Pdf Tool) where versions up to and including 1.20.25 fail to validate file types in the import_action function. This allows authenticated attackers with granted plugin access to upload arbitrary files to the server, with potential remote...

WordPress Plugin E2Pdf security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in WordPres...

WordPress e2pdf Plugin <= 1.20.25 is vulnerable to Arbitrary File Upload

Software e2pdf Type Plugin Vulnerable versions = 1.20.25 Fixed in 1.20.26 OWASP Top 10 A3: Injection Classification Arbitrary File Upload CVE CVE-2023-6826 Patch priority Low CVSS severity Low 6.6 Developer E2Pdf.com PSID fa835cc6ab49 Credits István Márton Required privilege Administrator Publish...

PT-2023-32780 · WordPress · E2Pdf

Name of the Vulnerable Software and Affected Versions: E2Pdf plugin for WordPress versions up to, and including, 1.20.25 Description: The issue arises from insufficient file type validation on the import action function, allowing authenticated attackers with granted access to the plugin to upload...

E2Pdf < 1.20.26 - Admin+ Arbitrary File Upload

Description The plugin does not properly validate upload files via the importaction function, allowing users having access to the plugin by default admin to upload arbitrary files...

E2Pdf < 1.20.19 - Authenticated (Administrator+) PHP Object Injection

Description The E2Pdf plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.20.18 via deserialization of untrusted input within the importaction and ajaxupload functions. This makes it possible for authenticated attackers, with administrative-level...

CVE-2023-5229

The E2Pdf WordPress plugin before 1.20.20 does not sanitize and escape some of its settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

CVE-2023-5229

The E2Pdf WordPress plugin before 1.20.20 does not sanitize and escape some of its settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

Cross site scripting

The E2Pdf WordPress plugin before 1.20.20 does not sanitize and escape some of its settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

CVE-2023-5229 E2Pdf < 1.20.20 - Admin+ Stored Cross-Site Scriping

The E2Pdf WordPress plugin before 1.20.20 does not sanitize and escape some of its settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

CVE-2023-5229 E2Pdf < 1.20.20 - Admin+ Stored Cross-Site Scriping

The E2Pdf WordPress plugin before 1.20.20 does not sanitize and escape some of its settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

CVE-2023-5229

The CVE pertains to the WordPress plugin E2Pdf (versions prior to 1.20.20). The root cause is that the plugin does not sanitize and escape certain settings, enabling stored Cross-Site Scripting by high-privilege (Administrator) users, even when unfiltered_html is disallowed. Affected: E2Pdf WordP...