CVE-2022-4553 FL3R FeelBox <= 8.1 - Moods Reset via CSRF

The FL3R FeelBox WordPress plugin through 8.1 does not have CSRF check when updating reseting moods which could allow attackers to make logged in admins perform such action via a CSRF attack and delete the lydlposts & lydlpoststimestamp DB tables...

PT-2023-14688

Name of the Vulnerable Software and Affected Versions FL3R FeelBox WordPress plugin versions 8.1 and earlier Description The issue concerns a lack of CSRF check when updating settings, as well as missing sanitization and escaping. This could allow attackers to make logged-in admins add Stored XSS...

PT-2023-14691

Name of the Vulnerable Software and Affected Versions FL3R FeelBox WordPress plugin versions prior to 8.2 Description The issue concerns a lack of CSRF check when updating or resetting moods, which could allow attackers to perform actions via a CSRF attack, potentially leading to the deletion of...

WordPress plugin FL3R FeelBox 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site request forgery vulnerability...

CVE-2022-4553: Cross-Site Request Forgery (CSRF)

The FL3R FeelBox WordPress plugin through 8.1 does not have CSRF check when updating reseting moods which could allow attackers to make logged in admins perform such action via a CSRF attack and delete the lydlposts & lydlpoststimestamp DB tables...

CVE-2022-4552: Cross-Site Request Forgery (CSRF)

The FL3R FeelBox WordPress plugin through 8.1 does not have CSRF check when updating its settings, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack...

WordPress plugin FL3R FeelBox 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed using the PHP language, which supports personal blogs on PHP and MySQL servers.WordPress plugin is an...

FL3R FeelBox <= 8.1 - Unauthenticated SQLi

The plugin does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection. 1. Visit a blog post and extract the nonce from the source search for "feelboxAjax", and extract the "token" curl -s...

WordPress FL3R FeelBox Plugin <= 8.1 is vulnerable to SQL Injection

Software FL3R FeelBox Type Plugin Vulnerable versions = 8.1 Fixed in N/A OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2022-4445 Patch priority High CVSS severity High 8.2 Developer Claim ownership PSID 949edd8b1308 Credits cydave Required privilege Unauthenticated Published 20...

WordPress FL3R FeelBox Plugin <= 8.1 is vulnerable to Cross Site Request Forgery (CSRF)

Software FL3R FeelBox Type Plugin Vulnerable versions = 8.1 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2022-4553 Patch priority Low CVSS severity Low 4.7 Developer Claim ownership PSID 95a213692f20 Credits WPScan Required privilege...

WordPress FL3R FeelBox Plugin <= 8.1 is vulnerable to Cross Site Request Forgery (CSRF)

Software FL3R FeelBox Type Plugin Vulnerable versions = 8.1 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2022-4552 Patch priority Low CVSS severity Low 4.7 Developer Claim ownership PSID bb443177825e Credits WPScan Required privilege...

FL3R FeelBox <= 8.1 - Settings Update via CSRF to Stored XSS

The plugin does not have CSRF check when updating its settings, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack Make a logged in admin open a page containing the HTML code below '...

FL3R FeelBox <= 8.1 - Moods Reset via CSRF

The plugin does not have CSRF check when updating reseting moods which could allow attackers to make logged in admins perform such action via a CSRF attack and delete the lydlposts & lydlpoststimestamp DB tables Make a logged in admin open a page containing the HTML code below...