CVE-2022-41609

Auth. subscriber+ Server-Side Request Forgery SSRF vulnerability in Better Messages plugin 1.9.10.68 on WordPress...

CVE-2022-45369

Auth. subscriber+ Broken Access Control vulnerability in Plugin for Google Reviews plugin = 2.2.2 on WordPress...

CVE-2022-41788

Auth. subscriber+ Cross-Site Scripting XSS vulnerability in Soledad premium theme = 8.2.5 on WordPress...

CVE-2022-41655

Auth. subscriber+ Sensitive Data Exposure vulnerability in Phone Orders for WooCommerce plugin = 3.7.1 on WordPress...

CVE-2022-40130

Auth. subscriber+ Race Condition vulnerability in WP-Polls plugin = 2.76.0 on WordPress...

CVE-2022-40216

Auth. subscriber+ Messaging Block Bypass vulnerability in Better Messages plugin = 1.9.10.69 on WordPress...

CVE-2022-40130

Auth. subscriber+ Race Condition vulnerability in WP-Polls plugin = 2.76.0 on WordPress...

Cross site scripting

Auth. subscriber+ Cross-Site Scripting XSS vulnerability in Soledad premium theme = 8.2.5 on WordPress...

Cross site scripting

Auth. subscriber+ Cross-Site Scripting XSS vulnerability in Quiz And Survey Master plugin = 7.3.10 on WordPress...

CVE-2022-40216

CVE-2022-40216 affects the WordPress Better Messages plugin. Affected versions are

CVE-2022-40130

The CVE-2022-40130 entry documents a race-condition vulnerability in the WordPress WP-Polls plugin, affecting versions up to and including 2.76.0. The issue allows authenticated users (subscriber+ level) to tamper with poll votes due to improper synchronization. Remediation according to the sourc...

CVE-2022-41655

CVE-2022-41655 affects the WordPress plugin Phone Orders for WooCommerce (versions ≤ 3.7.1). The root issue is a sensitive data exposure that is accessible to authenticated users with subscriber-level privileges (and higher). Documented impact is exposure of Auth. (subscriber+) data. The vulnerab...

CVE-2022-41788

The CVE-2022-41788 issue affects the Soledad premium theme for WordPress (versions ≤ 8.2.5). It is an authenticated XSS vulnerability exploitable by users with subscriber-level access or higher, caused by insufficient sanitisation/escaping of a parameter. A fix is available: upgrade the Soledad t...

CVE-2022-43492

CVE-2022-43492 affects WordPress with the wpDiscuz plugin at version 7.4.2. It is an Insecure Direct Object References (IDOR) in the Comments feature. The NVD entry lists CVSS v3.1 base metrics: 8.8 (High) with NEURAL: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H; PatchStack cites a lower impact vector. R...

CVE-2022-40698

Summary: CVE-2022-40698 is a cross-site scripting (XSS) vulnerability affecting the WordPress plugin “Quiz And Survey Master” (versions

CVE-2022-40698 WordPress Quiz And Survey Master plugin <= 7.3.10 - Cross-Site Scripting (XSS) vulnerability

Auth. subscriber+ Cross-Site Scripting XSS vulnerability in Quiz And Survey Master plugin = 7.3.10 on WordPress...

PT-2022-24630 · WordPress · Wpml Multilingual Cms

Name of the Vulnerable Software and Affected Versions: WPML Multilingual CMS premium plugin versions = 4.5.10 Description: The issue allows users with subscriber or higher user roles to change the status of the translation jobs due to a Broken Access Control vulnerability in the WPML Multilingual...

PT-2022-26073 · WordPress · Soledad

Name of the Vulnerable Software and Affected Versions: Soledad premium theme version 8.2.5 and earlier Description: A Cross-Site Scripting XSS issue affects the Soledad premium theme on WordPress, specifically for users with subscriber or higher authentication. This issue allows for malicious...

PT-2022-25288 · WordPress · Bp Better Messages

Name of the Vulnerable Software and Affected Versions: Better Messages plugin versions = 1.9.10.69 Description: The issue is related to an authentication bypass vulnerability in the Better Messages plugin for WordPress, specifically affecting messaging block functionality for subscribers and abov...

PT-2022-25983 · Unknown · Bp Better Messages

Name of the Vulnerable Software and Affected Versions: Better Messages plugin version 1.9.10.68 Description: The issue is related to an Authenticated Server-Side Request Forgery SSRF vulnerability. This means that an attacker could potentially forge requests to internal or external services, but...