CVE-2024-6756

The Social Auto Poster plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'wpwautopostergetimagepath' function in all versions up to, and including, 5.3.14. This makes it possible for authenticated attackers, with Contributor-level and above...

CVE-2024-6752

The Social Auto Poster plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘wpname’ parameter in the 'wpwautopostermapwordpressposttype' AJAX function in all versions up to, and including, 5.3.14 due to insufficient input sanitization and output escaping. This makes it...

CVE-2024-6750

The Social Auto Poster plugin for WordPress is vulnerable to unauthorized access, modification, and loss of data due to a missing capability check on multiple functions in all versions up to, and including, 5.3.14. This makes it possible for unauthenticated attackers to add, modify, or delete pos...

CVE-2024-6750

The Social Auto Poster plugin for WordPress is vulnerable to unauthorized access, modification, and loss of data due to a missing capability check on multiple functions in all versions up to, and including, 5.3.14. This makes it possible for unauthenticated attackers to add, modify, or delete pos...

CVE-2024-6751

The Social Auto Poster plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.3.14. This is due to missing or incorrect nonce validation on multiple functions. This makes it possible for unauthenticated attackers to add, modify, or delete post meta an...

WordPress Social Auto Poster plugin <= 5.3.14 - Authenticated (Contributor+) Arbitrary File Upload vulnerability

Authenticated Contributor+ Arbitrary File Upload vulnerability discovered by István Márton in WordPress Plugin Social Auto Poster versions = 5.3.14...

WordPress Social Auto Poster plugin <= 5.3.14 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Meta Update via wpw_auto_poster_update_tweet_template vulnerability

Missing Authorization to Authenticated Subscriber+ Arbitrary Post Meta Update via wpwautoposterupdatetweettemplate vulnerability discovered by István Márton in WordPress Plugin Social Auto Poster versions = 5.3.14...

WordPress Social Auto Poster plugin <= 5.3.14 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by István Márton in WordPress Plugin Social Auto Poster versions = 5.3.14...

WordPress Social Auto Poster plugin <= 5.3.14 - Missing Authorization via Multiple Functions vulnerability

Missing Authorization via Multiple Functions vulnerability discovered by István Márton in WordPress Plugin Social Auto Poster versions = 5.3.14...

CVE-2024-6755

The CVE-2024-6755 entry concerns the WordPress Social Auto Poster plugin (versions up to and including 5.3.14) suffering from a missing capability check in wpw_auto_poster_quick_delete_multiple, enabling unauthenticated actors to delete arbitrary posts. The connected data corroborates the root ca...

CVE-2024-6754

The CVE-2024-6754 entry concerns the WordPress Social Auto Poster plugin. Affected component: wpw_auto_poster_update_tweet_template. Root cause: missing capability check enables authenticated attackers with Subscriber-level access and above to update arbitrary post metadata in all versions up to ...

CVE-2024-6754 Social Auto Poster <= 5.3.14 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Meta Update via wpw_auto_poster_update_tweet_template

The Social Auto Poster plugin for WordPress is vulnerable to unauthorized modification of data to a missing capability check on the ‘wpwautoposterupdatetweettemplate’ function in all versions up to, and including, 5.3.14. This makes it possible for authenticated attackers, with Subscriber-level...

CVE-2024-6752 Social Auto Poster <= 5.3.14 - Authenticated (Subscriber+) Stored Cross-Site Scripting

The Social Auto Poster plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘wpname’ parameter in the 'wpwautopostermapwordpressposttype' AJAX function in all versions up to, and including, 5.3.14 due to insufficient input sanitization and output escaping. This makes it...

CVE-2024-6750 Social Auto Poster <= 5.3.14 - Missing Authorization via Multiple Functions

The Social Auto Poster plugin for WordPress is vulnerable to unauthorized access, modification, and loss of data due to a missing capability check on multiple functions in all versions up to, and including, 5.3.14. This makes it possible for unauthenticated attackers to add, modify, or delete pos...

CVE-2024-6750

The CVE-2024-6750 entry for the Social Auto Poster plugin (WordPress) is supported by multiple sources describing an unauthenticated flaw caused by missing capability checks in several functions through version 5.3.14, allowing an attacker to add, modify, or delete post meta and plugin options. P...

CVE-2024-6750 Social Auto Poster <= 5.3.14 - Missing Authorization via Multiple Functions

The Social Auto Poster plugin for WordPress is vulnerable to unauthorized access, modification, and loss of data due to a missing capability check on multiple functions in all versions up to, and including, 5.3.14. This makes it possible for unauthenticated attackers to add, modify, or delete pos...

CVE-2024-6756

The CVE-2024-6756 entry concerns the WordPress plugin Social Auto Poster. Affected versions up to 5.3.14 allow arbitrary file uploads due to missing file-type validation in wpw_auto_poster_get_image_path, enabling authenticated users with Contributor+ permissions to place arbitrary files on the s...

CVE-2024-6756 Social Auto Poster <= 5.3.14 - Authenticated (Contributor+) Arbitrary File Upload

The Social Auto Poster plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'wpwautopostergetimagepath' function in all versions up to, and including, 5.3.14. This makes it possible for authenticated attackers, with Contributor-level and above...

WordPress Social Auto Poster plugin <= 5.3.14 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by István Márton in WordPress Plugin Social Auto Poster versions = 5.3.14...

WordPress Social Auto Poster plugin <= 5.3.14 - Cross-Site Request Forgery via Multiple Functions vulnerability

Cross-Site Request Forgery via Multiple Functions vulnerability discovered by István Márton in WordPress Plugin Social Auto Poster versions = 5.3.14...